Think about it this way, you don't need AP number to make a booking, so they won't ask for it when cancelling.

I remember a couple years back I was making some changes on CA and NH tickets. I didn't have FF account with them. All they asked were ticket number, name, and flight details.

Also, I think normally when you cancel a ticket, the refund can only goes to the CC which paid the ticket. So it's highly unlikely that someone can cancel your ticket and get your money.