Deal bloody vengeance. This behavior should be actively and ruthlessly punished.
Do a chargeback
Contact your credit card company and tell them you didn't authorize the additional charges. This has a very bad effect on the illicit vendor.
Credit card companies do not like chargebacks. Whenever a merchant has a chargeback, they punish them several ways: first by charging them an investigation fee, second (if they have a high rate of chargebacks compared to successful transactions) they will increase their fees for all transactions and delay their payments, and third if the chargeback rate is serious enough, they will ban them from doing credit cards altogether and seize their last owed payments to settle anticipated chargebacks.
So it really screws them up when you do a chargeback by contacting your credit card company. If the crook is dealing with a shady bank, then that will also put the bank under stress. Everyone who does a chargeback helps this. Everyone who "lets it slide" enables these crooks.
The credit card system Does Not Like transactions like this, and will punish their practitioners.
I wouldn't bother canceling/reissuing the credit card unless the issuer asks you to. For one thing this doesn't cancel recurring subscriptions - they follow you onto the new card number. What's more, if the shady site does use your card data again, it means they retained your expiry and CVV#! Which they are absolutely not allowed to do. There is no non-criminal reason to retain that data - their re-use of that data is prima facie evidence of crime. And obviously you can chargeback that as well. Dare them to! LOL
Do not deal with shady sites directly!
They are shady, obviously! If you let them reverse the charge, then they evade the chargeback consequences they richly deserve.
You have no reason to interact with them. You have no obligation to "try to resolve the dispute with the company first" because you never had a relationship with them in the first place. Treat it as fraud, let them pay the consequences to the credit card system.
This is a typical "crooks targeting crooks" scam
College students are frustrated because textbooks which they are assigned are often very high priced. Some students illegally scan copies of the textbook and distribute it online for free, typically using P2P file sharing... which is technically complex to do secretly. Whether this is flat out crime or civil disobedience against injustice is a complex subject I won't address here.
Due to the complexity of P2P file sharing, students look for an easier way. There are often "PDF sites" which mirror all the stuff found on P2P websites, or merely pretend to do so.
So the concept is that they are hoping the customer won't report them because the customer is breaking the law. But that doesn't make any sense. What is their "nuclear option"? Telling the textbook publisher exactly what you were downloading. But to do that, they would be also admitting to the publisher that they hosted the book for distribution for pay. And that is much worse. And, they have no incentive not to lie, since their report would be retaliatory. So the deterrent makes no sense.