This question has been asked many times, and that's perhaps why Google has clarified what you should do if you've discovered someone using your ad code.

What to do when I discover another site using my ad code.

It's quite clear that you should verify your own sites and turn on authorization. Once on, you will still see the unverified sites, along with impressions and clicks, but advertisers won't be charged, and you won't be earning anything from the unauthorized sites.

[adsense.googleblog.com...]