Sounds like a really ...... outcome. Likely that something being booked from someone else's account may have triggered something.
It's not rare for CSRs (different industries) to be instructed to just "do as requested", and report the incident on the side without saying anything to the client, and to let Compliance handle it.
One way International OAL same day booking for a third party is not uncommon for fraud. Reason being that if a fraudster books a ticket say with AC with the first segment on an OAL, and the passenger checks in on the OAL right away, coupon control goes to that OAL and AC is SOL with the ticket and unable to refund. The fraudster will fly the OAL, AC will get a charge back, and the OAL will claim their share. This is probably why AC took the ticket / coupon control away from UA.
Still sucks.