It also doesn't matter If the bad guys sold the points by issuing a ticket for John Q. Smith and someone with that ID showed up at the airport, he would be boarded. Because he is John Q. Smith.
If OP kept a CC on file (anybody who still does this with WN or anybody else is a prime candidate for fraud and identiy theft), he should also report this to his card issuer and obtain a new card.