The fact that one was used for OP's upcoming stay suggests a relatively sophisticated employee fraud.

It seems a bit hard to erroneously apply one to OP's upcoming stay, close out his account, open another, erroneously apply OP's to the new account and then close that out, all without alarm bells going off. But, by taking care of OP's upcoming stay, the agent has eliminated the concern that OP will discover the fraud immediately unless he is vigilant. Unfortunately, OP is vigilant.

OP - Glad it is solved. I would still send a written webform complaint to Hyatt thanking customer service for solving your problem, but asking that the matter be referred to corporate security. The employee ought to be dealt with and you do not want your account flagged as having been involved other than as a victim.