There are so many ways that your information can get stolen, it's positively terrifying. I wouldn't think that if someone in josh's operation had your info, they would wait months to use the cards. I would bet that somewhere else there is a common thread, or it could be a coincidence that both of you got "cloned" at close the same time. Gas stations, kiosks in a mall, restaurants, everywhere you swipe your card are potentially corrupted and can get all of your info off your card. I have had several cards compromised in the past few years, including two AmEx cards and a Capital One Visa Card. In two of them, the fraud departments noticed charges that were outside my usual spending pattern, and called me for verification, the third involved a series of very small charges which the I noticed and called the credit card company. The fraud folks told me that sometimes the thieves will go on a "fishing " expedition, a few small charges to see if it's a good card, then they make a bunch of big charges and are gone.
The best protection is to be very diligent in checking your statement. Set it up online so you can check it often and not wait on a paper bill. Also the credit card companies will often work with you to tighten the restrictions on the cards, Sometimes that is a PITA, but it's better to have every sales clerk ask for a photo ID than have a bunch of stuff charged to your card. On my AmEx cards, I have it set up that no charges are allowed unless the shipping is to my home address, unless I specifically call and tell them I need to have something shipped somewhere else. they did that after I got hit for about 6k in merchandise that was being shipped to an address several states away. I didn't have to pay a cent, but the credit card companies don't like to have to go to their customers and tell them they are clawing back money from fraudulent charges.