If you're in the US, the AA privacy policy pretty much governs what AA can and can't do with your information: Privacy policy − Support − American Airlines (aa.com)

The AA privacy policy says that you should keep your record locator confidential so it's odd that AA would Tweet it. But the privacy policy specifically allows use of it:

"to complete transactions and fulfill requests for our products and services."

So I don't think you have any claim against AA. Such is life in the US (unlike in the EU).