Call and ask for the Fraud Desk -- you may or may not get connect but raising the issue of a comprised account might help.

Question -- have you done multiple searches using those 1016 codes in the past. Vaguely remember a posting / thread relating the code will become invalid if used for >X searches, even if never redeemed.