Not necessarily.

Seems the only sure way to stop the thieves from getting the loots is to STOP the shipment, but not invalidating the goods that already out of the door. That is based on what happened to hacked United accounts a few friends experienced several years ago. A friend's 300K UA miles were gone - all redeemed for MacBooks and iPads, shipped to various places incl one a shipment forwarding warehouse at Long Beach. UA could only stop the lots sent to Long Beach, the rest were gone for good. Like the OP, my friend literally saw the miles flying out of his account in front of his eyes when he happened to log in to check award space - then the account was not accessible any more from laptop, but still able to from phone, and then stopped.

As with many hacks, his email address was changed by hacker thru calling in and did it with an agent.

Also frequent reports from UK FTers on their IHG accounts being hacked and giftcards redeemed, those Amazon gift cards still went out and redeemed.

Some airline FFPs, notably Japan Airlines and ANA, now allow members to get a phone security code attached to the account so without the security code verified, agent would not do any modification on anything. IIRC long time ago SPG required a phone security code when calling in to do something.
AMEX still asks for security question when calling in, isn't it?