This hacking has happened to me before. They even added a credit card number to the profile. They reset my account, put the miles back in, then said I needed to add a pincode next time or they would not refund the issue in the future. They could not figure out how it happened. The way I found out was due to Awardwallet, as the "hacker" added a new e-mail address for confirmations.