In the abstract, it is "only a couple of plane tickets." But, in reality, this happens with some frequency and if it is not caught & dealt with, that is where the fraudsters go.
Years ago, what was then Bell Atlantic used to follow up on $0.05 pay phone frauds when people used tone generators to beat the then unsophisticated system. I suspect that Bell Atlantic could have cared less about any $0.05 loss, but overall it knew that if it did not crack down, the fraud would become massive.
If these tickets represented $5K in revenue forgone each, that is $15K. If that happens only 200x / year, that is $1 Million in shrinkage to AA. And 200 would be the luckiest year in AA's recent history. By far.
It is always possible that whoever did this did it for his own account and never did anything like this before and will never do it again. But, that is not reality.
Three separate tickets on separate dates screams out a ticket broker who does this regularly and a sophisticated operation which does the hacking and sells the information.
Here, AA will have CC information (likely stolen / hacked) and that is another lead.
Maybe the guy already in the air beats everybody to the destination. But, it is easy enough to flag the other two tickets and either cancel them or let them stand and see who shows up.