Note that Marriott allows you to have a security code protected account. This means that before someone can pull points from your account like this, they would have needed to get that security code. I would assume your wife's brother wouldn't know what the code is and thus the hotel wouldn't have been able to extend the stay using points.

You would need to call MR up and ask for your account to be security protected. From that point on anytime you call in to order an award, even if the agent has verified who you are, they won't be able to pull the points unless you can give them that code. (My understanding is they can't see the code and will just put it in when you give it to them. So its not a case of an agent forgetting to ask about the code. Its a case of their system won't let them pull the points unless you give them the code.)