Nice, definitely agree cancelling was the right call in this case. @Rob Simari was working on this case yesterday.
It's overwhelmingly likely that this child has "Share Across Devices (SAD)" on so her thresholds of message usage get reported to us from both devices.
We don't have a sophisticated strategy for filtering out these cases yet, but Rob is working on it. The hard problem is accommodating these cases (IE throwing out the threshold events from the second device) while also handing instances where SAD is off (IE we should count thresholds from both devices)