The pax may not be the thief. He/she may have bought it.

15 years ago, there were many similar cases with credit card. Ignorant pax were purchasing cheap tickets from con artists who were buying valid tickets with stolen CC numbers. It was usually done at the airport. When the legitimate CC holder realized, the flight was long over.
The "TA" name, company etc were all phoney, and based in Africa where you could not rely on international police cooperation.
At that time, airlines ate the bill. Since then, airlines require the proof that the CC holder is OK, when pax name and CC name are different. Some are even prohibiting it.

This present case should be the same. EK should bear the loss.