With the one seemingly reliable data point posted on Reddit yesterday, these were the stated facts:

- Recently created 10 AA accounts with same physical address to receive emailers (to turnaround and use/sell) And the person did in fact sell some of the codes.
- Those dummy accounts were created utilizing the Gmail . trick with the same email address used on the primary AA account
- Only booked award travel for immediate family with same surname
- Single player, no other players or extra AA accounts with points in them (although family member just did get their first AA card who resides at same physical address last month)
- Future AA award flights for family members not affected
- Approx 1mm points in account balance

Speculation in that thread focuses on the Gmail . (dot) trick and/or the selling of codes as the likely critical point(s) of failure. I'm not sure the Gmail issue would necessarily have been the tip-off by itself but who knows. The way I read the post, the 10 new accounts were created at the same time, or close to it. That's quite a velocity...combined with selling codes, that's a pretty big exposure to possible prying eyes at AA. Just my two cents.