Extremely unfair, Eldest and youngest should not have been punished at all.
BUT I'm also going to go against the grain and say I think that that one month ban is plenty of punishment for the middle child. His only crime really was being a little sneaky and lying to his sister. He's 8. A weeks ban from the ipad would be plenty punishment in my eyes.
As for the astronomical amount, that is horrible, but not the boys fault. I highly doubt he realised the sort of money he was racking up or even what that would really mean for his family.
This comes down to extremely poor and lazy parenting basically. Why is the 11 yo given a password for it at all? Because they can't be bothered typing it in every now and then when she wants something? Why aren't the settings set so that the password is required immediately rather than in 15 minutes? (My son's ipad is set to this even though he's never given the password. Just in case.)
Why is the boy going to his sister to ask for the password... where are the parents? How could they not see him asking?
I am really glad that they got the money refunded, because that's a hell of a lot of money to have to pay for a bad parenting stuff up, but I bet it's them that learn a lesson out of this much more than their kiddos.