I just posted this on reddit, but figured would echo it here as well.

Just logged on to check mine the other day and noticed a 30,000 point Avios redemption from May 12th.

I had not made any bookings nor did I receive an email about one being made. Immediately changed my password and started dialogue with BA. Turns out the points were used to book an inter-Russian flight for 2 passengers. They read me the names and said that the itinerary confirmation email was sent to another email address. Case has been moved to the audit department as fraudulent activity to hopefully get my points back.

Could be isolated, but figured I would put that out there in case you don't check all your accounts daily, especially the ones that you don't use often.