I have two "guesses" as to why. First, rumor has it that the Delta SM system is now running on the WP system. That system (i.e. nwa.com) required last name. Second, because both nwa.com and delta.com let one log in using both WP and SM numbers (granted delta.com won't let you get far on a WP number) I would imagine there is some account number overlap. So requiring last name makes it easier to identify the user.

Either way, requiring last name is a nice (and fairly painless) security improvement. PIN codes are fairly insecure and account numbers (I believe) are sequential. It makes it that much harder for someone to break into an account; while using a value that everyone knows about themselves.