Hasn't there been other threads similar to this, and the issue was either the names or the Bonvoy numbers were very similar? It ended up not being fraud, but basically a computer error.

It would seem pretty unlikely that the person would be able to continuously get into the account.