This issue has nothing to do with the DOT rules or AA's hold or extended hold offerings. It is strictly a factual dispute between AA & OP. AA states that OP cancelled his hold prior to the expiration and OP states that he did not.
AA's Web Services looks at the account logged in at the time the cancellation was done and the IP address used. I am going to presume that the account was OP's and the IP address match's the address used to make the held reservation in the first place which is why AA is adamant here.
Rather than fussing here about the rules, because those are not in dispute either by AA or OP, I would call Web Services back and obtain the time the cancellation was supposedly made and ask for the IP address which AA is showing for the time the held reservation was made and then cancelled. AA may not provide the latter, but it might, so asking can't hurt.
At least with that information, OP can consder whether there is any other person who legitimately has his login credentials (a violation of AA's T&C) or whether this is a malicious hacker (different IP address).
Presuming that OP can eliminate anybody else legitimate, I would rebook this as soon as possible so as not to lose out on whatever savings there may still be and then send in a written request (this is not something which will be resolved by phone) asking that AA review this and making the express written statement that OP did not cancel the held reservation. The written request should offer to place this statement in an affidavit.