I think AA saw that someone brought a huge number of miles then suddenly booked a ticket for someone that may have not had a clear family relationship. I think these two acts in combination would draw security. With different last names and addresses (I assume) AA would not know there was a family relationship. Add in the fact that AA was likely initially looking at the account due to a Craigslist posting and you understand why AA cancelled the ticket and took away a large chunk of miles. The best thing the OP can do is come clean and provide some kind of proof that the ticket was given free of monetary exchange to his Aunt. What kind of proof AA would demand IDK.