I had something similar without even staying at the hotel.

I recently made a fully flexible reservation at Courtyard Boston.
I had to cancel this booking and did so receiving a cancelation number. This booking was a fully flexible booking with no cancellation fee.

That should of been the end of it but, I received two emails from the hotel thanking me for my stay (different dates to my canceled booking) One from the GM and from /guest services with my Membership rewards number but under a different name (they supplied the name). I do not know this person. I did not stay at the hotel and nor did I make this reservation for the other person.

The hotel also charged the credit card that was on file for my booking for the other persons stay. So somehow the hotel mixed up payment details/membership details. I contacted the hotel and they were quick to refund the money back.

It's a little worrying that this kind of mix up can happen.