Until OP reports back what reason Security gives him when he finally gets additional info from them, there really isn't much more we can do is speculate.

Calling about a wife's account isn't going to cost a 1.7 million mile penalty.
There is more to this.
OP indicated "No fully flexible fare cancels"
What about non flexible fare cancellations?
Has the OP or wife ever used award miles for anyone else, or has ever posted them for sale, even if you later removed the posting, and no sale took place?
There really isn't much to go on here, such as OP reported he did nothing wrong.
Until there is a more clear communication with Security there is nothing to do but wait