If your account was hacked, report it to the police. Barnes and Noble will have recorded the IP address of the incoming purchases. It will be fairly simple to determine the ISP to whom that IP is registered, and (if the police are involved) get a court order or search warrant directing the ISP to release the subscriber info.
Since the Color does not have 3G, the transaction will have had to occur over wifi if it came from the device, as you stated. Whether that IP address leads you to a residential wifi network, or to a free wifi hotspot is another question, but the police can cross that bridge when they come to it. Not sure how you will convince B&N that it wasn't you, short of maybe the police interrogating the router that was issued that IP address to see if your device's MAC address is listed as having been connected, in the unlikely event that the router is advanced enough to keep that info, and is set to (getting a bit far afield here
).
The bottom line is, if you did not commit the transactions, it's a crime. If you lived in my state, two felonies have occurred - Access Device Fraud and Unlawful Use of Computer. The answer is not to eat the two transactions and never deal with B&N again.