It could also be something via a third party seller, and not directly from VMWare.  I don't recall them ever using Digital River.

Other thoughts: contest the charge with your credit card company as invalid.  That'll force the charger to prove it's legit.

Worst case, you can always cancel that credit card and get a new number.  I've had to do that in the past.