Can a cell phone be cloned without leaving my posession?

I have an ATT go phone with a sim card. A couple of weeks ago, my cell phone unexpectedly logged on to the internet twice and used up my balance. I never touched my phone. After speaking to customer service, they reimbursed me for a partial credit and shut off my data plan, thinking that I inadvertently hit the internet button on my phone, Today, I added some money to my phone and a couple of hrs later, I had two separate charges on my phone history that I either downloaded either a ringtone or some other app, twice for $5 each. Again, I never touched my phone, There was also an attempt to call someone in Puerto Rico from my number, but the call never went through. Also, the phone never left my possession. How is this all possible, as ATT customer care is not helpful?