If a user raises concern about being charged for a course without authorization, ask about the payment method.
If they paid via CC, the possible ways to complete an order is to: Checkout (with the specific product in cart) and enter their CC details & submit.
If they paid via Paypal, it would require them to login to her Paypal account during the checkout process.
Both methods require a certain amount of knowledge about their payment method & account...
If they didn't do it, the last possible scenario is if someone else has access to their account / device, and that has all the payment details saved.
It can't be a Woocommerce glitch because Woocommerce doesn't save any user payment details except billing address, but not their CC details or Paypal login credentials
The questions to ask:
If they paid via CC:
Does anyone else use their device?
Do they have their CC details saved on their browser?
If they paid via Paypal:
Does anyone else use their device?
Do they have their Paypal login details (user & password) saved on their browser?
They will have to contact their bank.