I know with some companies you can only leave one person authorized on the account, and have a "pin". I would see if you can do that here to prevent any future incidents in case. Other than that, even though the phone company should have used better judgement you are responsible for the bill, and you need to get your son to pay you for it, whether it be with money, doing chores, etc. Or maybe take his phone away from him to teach him you mean business. Hopefully you get a response explaining why he was granted access to your account and their reasoning behind it because I think that is wrong.