Assuming that paper with the PNR hasn't been left around, an easy way for someone to get all PNRs is to hack into the email to which information about reservations and ticket receipts is being sent.

Has your family fired anyone in the interval before these things started happening? Perhaps there's a disgruntled housekeeper etc. who might or might not be in California.