After reading through this entire thread, some comments:

- Citibank buys miles in bulk from AA. If tickets were purchased and cancelled, with the Citibank account closed before making Citibank whole, Citibank suffers the consequences, as AA already has already received their money from Citibank. However, this does not seem to be a Citibank initiated action.

- Buying and refunding a large amount of tickets should (hopefully) not be a red flag to AA. I book tickets as soon as I know my schedule, and cancel and rebook as my schedule changes. I would estimate 25% of my monthly F/J tickets are refunded back to my Citibank card. A perk of purchasing refundable tickets is being able to cancel without question, and if AA ever asked me to "prove" my flight patterns, business cycles, or tickets receipts from the past two years, they would receive a very unflattering response.

- The OP is stating AA has an issue with 10% of his 2M accrued miles. If this is truly the case, then this is a good sign AA must have minimal fraud in that they can focus their resources on an account of which only 10% of the miles are called into question.