You have completed a reasonable investigation by examining the sales receipts and therefore, are allowed to repost the amounts to the account.
Since the ATM transactions occurred during the same period, and you have evidence the card was still in the consumer's possession at the end of the so-called fraud period, you are allowed to include those amounts as well.
I'm assuming you are still within the resolution timeframe (45 days). If so, when you repost, I would recommend sending copies of the evidence to the consumer with your notification.
_________________________
My opinions do not necessarily reflect those of all the voices in my head.