Hotel can claim back the points but any existing bookings should just be honored and allow guests to have a negative balance until enough points get earned to recover those points. The rogue employee is the hotel's problem and the hotel should deal with it, maybe first step is to fire the employee, and then maybe go after the employee for damages.