Originally Posted by GetawaysRus

I'm not trying to hijack the OP's thread, but in my case:

I had not been following my PC account closely for several years (was staying at Marriotts primarily). But I got active again when I picked up a Chase Priority Club credit card. I updated all the contact info in my PC account. A few months later, I received an email notifying me of an upcoming reservation that I had not made, and that's how I realized that something was going on. I phoned about the fraudulent reservation and learned that there had already been a few stays that were more than 1-2 years old. PC refused to refund me the points for those older stays.

Morals to the story: pay attention to activity in your account, keep your PC profile (and email address) up to date so you learn if something odd is going on, and call promptly if there is unauthorized activity.