One PPPoE username used in several homes means one payment for several customers. It is common, and it is hard to see without the right tools.
Limit devices per account
Set how many devices can log in with one PPPoE account, on the plan or per customer. Most homes need one or two; when the limit is reached, extra logins are refused.
Control where a login works
Lock a customer to one router or to their station, so their login only works where they are installed.
See it happen
For any customer you can see the router, IP, MAC address and session they connect with, and how many of their devices are online.
Keep your lists clean
Review dormant and suspended customers regularly, and close accounts that are no longer used so old logins cannot be reused.