Generally, I'd say that since you were notified within 30 days of statement from which the first transaction occured, that the customer is not liable unless you can determine that they knew their card was missing/stolen sooner and did not notify you within 2 days.
If the transactions were "signature based" and are VISA or MC branded, the transactions are probably subject to $0 liability per their rules.
_________________________
Liability for taking my advice is limited to the amount you paid for it.