The action of CO is definitely correct, in suspending the account if miles have been sold from it.
Now, the wording of the letter can be better. Instead of outright saying the member is selling miles, they should just say there's suspicious activity, and that the member needs to contact CO to resolve the situation and reactivate the account after figuring out what happened to it.