The agent told you up to six months because it could theoretically take that long and it is far better to tell people that and get it done in 6-8 weeks, than the reverse.
AA will investigate and dig down to figure out who did this. Entirely possible that the actual passengers responded to ads for cheap F tickets and and by tracking them, AA can get back to the brokers who do this for a living.
On the other side of this, AA will make certain that you are not part of the fraud or that the hacking did not occur by someone with access to your account.