A suggestion, Marriott will allow you to set-up a security code that has to be provided before changes and/or point usage is performed by a phone agent. I set that up for my account years ago and now every time I call in to make a change to my account or order an award, I have to provide that code before the phone agent can complete my request. And while I'm sure it won't completely fix every "mysterious" change to my account, it might be able to reduce chance occurrences of changes.