Yes, many times the passenger is not the one that has breached the account but a broker of some sort. Confronting the passenger at the airport might get you the supposed identity of the broker, but more likely they never give their real name and thanks to the internet may not have a physical address where they conduct business. This all sounds like it would be simple to follow up on, but it really isn't (anyone try stopping spam messages lately?). I'm sure AA would like to find someone to eat the cost, but most likely it will be them. More security would be good, but there is a cost to implement that and the added frustration to the customer.
I really hope the six month timeframe was a worst case scenario and not the norm.