If he/she ordered from the channel directly, most likely have to contact the Subscription provider directly.
Afterwards, might be a good idea to setup a PIN in your Account Dashboard to prevent that again. Can setup to either have to approve purchases, installing channels, or both.
Just to make sure, this was a legitimate channel Subscription right? Not a Premium Access for Roku Services or the like? Some scams/frauds lately for Roku online charging for a Roku Premium Subscription.