There is about a 100% chance that this is not southwest's fault, and about a 100% chance that someone got into your account because you either reused a password from another site (that got hacked), or disclosed your password in some other manner (phishing, etc). That most certainly being the case, southwest has no obligation to reimburse the points to you, so just know that going forward, and interact with them accordingly, ie. that they are doing you a favor by investigating this, as it was almost certainly not a failure on their end.
That being said, they will probably reimburse your points, but chances are you won't find out who did this. My guess would be some unknown 3rd party got your password, logged into your account, changed your account info, then bought tickets for people online who paid the 3rd party, not realizing the points were stolen. You may be able to track down the people who used the tickets, but chances are you'll never locate the "hacker" who likely profited off selling your points (chances are they aren't even in this country).
Going forward, practice good password security to avoid things like this happening in the future, other companies aren't as good at southwest when it comes to covering losses that aren't their fault.