I can't offer you any insight into the failing of IHG, but it appears to me that if you've had multiple online accounts infiltrated, then it's likely all come from your mail email account being hacked into and then each site letting the attacker in through their email loop password recovery systems.

I wish you luck in recovering the points.