There are many ways it could have happened. The more likely ones:

- You use the same password on multiple web sites and at least one of them had account information stolen The person was able to deduce your password from that set of data (i.e. weak or no encryption on passwords)

- You have a weak password and they were able to guess it. They either had your Skymiles (do you have a brag tag) or username (you use the same username on multiple accounts)

- They called Delta and conned them into getting access to your account

- Your computer is infected with malware that steals credentials

They way to protect yourself is to strengthen your security posture.

- Use strong passwords

- Use a password manager

- Bin your online accounts into 3 tiers.

Tier 1) Important- Each has a unique username and unique passwords. Recommend using an email address that is unique.

Tier 2) Useful- Reusing usernames is permissible. Unique passwords is a good idea, but not required. You can use your regular email address.

Tier 3) Throw away- Use a separate email from your normal address to register. The username should only be reused within this Tier.