What happened was that at some time around the end of 2019 the credit card expired and nobody noticed it. The API just kept on working for our services, so we assumed everything was fine and we were probably within the free tier. The card was added and account configured by someone not working on the project anymore.
Then recently the service just stopped working and after a bit of digging around, we found that the account had racked up a bill of $20.000 since the end of 2019. Slowly and steady each month. It was nice enough of Google to give us quite the credit period there, but as it turns out after inspecting the cost breakdown, someone else must have been using the key since a lot of the requests were to API endpoints totally unrelated to the services we provide.
We screwed up big time by having an unrestricted key configured. It was setup in 2017 way back when things were free, so I doubt anybody actually thought about abuse of the key at that time, but none the less, here we are having our key abused.
Do we even have a chance here? Did anyone get into a similar situation? I would be grateful for a little bit of advice about how to approach Google. I realize this is our fault, but at the same time, it seems we never got any payment reminders or notifications that we had bills overdue - at least we cannot find them anywhere.