While I won't go into details I also had to do a reset lately and agree the idea of sending pin through email in not good...

Being concerned for the points in my account my thought was to book a refundable reward night for a year out "dreams or hope to vacation" - say few nights at high value IC to store few 100k points - then if I need the points at anytime I can cancel that which will credit them back. I feel this is a good idea for two reasons: firstly a hacker is probably just looking at account balance & secondly if something did happen with that reservation hopefully IHG could reinstate.