He was undoubtedly wrong to do this, but AA are also culpable with their incompetence. AA made a deliberate decision to do things on the which exposed them to this kind of fraud.
Some only learn fire is hot after they get burned
Cheaters cheat.
In order to cheat, they need to find methods which allow them to do so.
Business's set up procedures in order to allow customers flexibility when using or purchasing their products. Sometimes, the purchasing systems being used don't get all the i's dotted and t's crossed. An honest customer will not exploit the vulnerability, the cheater will look for it.
We could always go back to cash payments made in person for secured tickets to ensure safety to the system, but 99.9% of us don't wish that to happen.
It's the 1% where we need law enforcement, fines and prisons (and that doesn't stop them anyway
)