Yup, cancel the card. Could have been compromised online, phone order or from a in-store purchase via a receipt (some stores don't block out your card number or expiration date on the printout, if you tossed it and didn't shred it, that's another way). As others mentioned, could be a friend of family member too. Something to consider.
In another life I developed fraud indentification systems, strategies and business processes for one of the largest credit card companies in the US. You'd be surprised how good the investigators are at tracking folks down. Unless its part of a professional ring, good chance they'll get nabbed if the dollar amount is high enough. FBI and Secret Service get involved with the big rings. Interesting stuff.
Though it sounds like there aren't huge amounts involved, so the credit card company will probably write it off or charge it back to the merchant. Mail Order/Online purchases favor the consumer and bank in this case.
My advice would be to contact the 3 credit bureaus in the US and put a fraud watch on your file. If the individual potentially got more personal info, they could apply for credit in your name. A fraud watch puts a flag on your file that requires the lender and in some cases the credit bureau itself to contact you if someone applies for credit with your info. Adds a step for you, but makes it much more difficult for a fraudster to tarnish your credit.
Talk to the fraud department at your CC company. They have the numbers.
Don't worry, you aren't liable for the charges.
P4 2.6C, Thermalright SP94/Panaflo 92MM M1A, IC7 Max3, Swifty MCX159, 1GB Geil PC4000 Ultra Plat, Radeon 8500, Audigy 2, 2X WD Raptor RAID 0, WD 250GB SE, Plex 708A, 166SDVD, LianLi PC75, XP Pro.