Fwiw, another possibility is sheer incompetence at a call center. With Hilton, three times in the last four years I've had my HH number used to redeem points or make a reservation by 800# staff using my number that I did not initiate.

In each case the traveller supposedly had the same name (my first name is very common but last name is not) and it was a real PIA to unwind especially the two where the guest was already checked into the room at a property.