Delta should be able to audit your account and determine how the points were taken and the email address changed. The owner of the bogus email address's domain can also provide some information, if they're willing to not be the criminal's accomplice.