The authorization (consent) was given the moment the guy linked his creditcard with 14k+ credits to his tesla account. Then, he gave the login to a third party

The authorization (consent) was given the moment the guy linked his creditcard with 14k+ credits to his tesla account. Then, he gave the login to a third party. Lots of things that one should simply not do, and is not the fault of tesla (which should have spend the time to at least have a confirmation prompt, I totally agree, but that's an extra service to the not-so-very-smart-people who blindly link their creditcard to stuff)