just ignore them, "firm action" just means they will shut down your account, which I am prepared for every time I am going in...no risk no gain

according the letter wordings, looks like the broker (who's probably known to AA) bought the ticket using his name?

by giving broker account access, I wonder if it's safer for the broker to buy ticket in account holder's name as if the account owner were buying himself ?

there is no violation of terms if buying for a friend, but if account holder / purchaser / ticker holder are all different, it can easily raise red flag