Funny this comes up now... I just had a 2-night point stay that I needed to extend. I stopped by the front desk on night 2 and was told they can not pull the extra points needed for the third night and I had to call MR or book another stay. OK, I was fine with that. Went back to my room, got online and booked the following night. Called the front desk with the confirmation number and she said she was checking in new guests and would call me back. No call back. Stopped by the desk in the morning (different FDC) and was told the new rez was not needed and she knew how to extend my current rez and take the extra points. She recoded by key and I was all set. Appears to have worked, second rez was canceled and there was a point pull for the extra night. Also, at no time was I asked for any password/passcode or ID!
Bottom line, you have different levels of abilities and will get different answers based upon that. Allowing a non-member to have access to member accounts is wrong. Sister should have a chat with brother, he may be thinking he was going to pay for the stay and the hotel forgot to bill his CC (or worse yet, hotel DID bill his CC AND pulled extra points).