Originally Posted by
alex_b
...this is almost certainly not someone picking up discarded boarding passes and brute forcing the PIN.
I think that your account gets locked after three or four incorrect login attempts, so "brute forcing" (if by that you mean trying different PINs) wouldn't work very often.