WN isn't obligated to restore the points -- the terms of the RR program specifically state that they have no responsibility.
Generally, however, they often do. Once they can prove that the member was actually a victim of fraud. Information regarding the investigation is, for obvious reasons, not released to the customer.
Southwest would do well to increase it's account security measures -- many options are available. But since there's a cost involved, and since Southwest ultimately isn't responsible for stolen points, there's no strong motivation for them to do so.