It's really strange that only 1 sector was credited to the alleged fraudulant account when they had a chance to have the rest stolen as well. What was the frequent flyer program listed on the boarding pass? I usually monitor the digital boarding pass on the app even before boarding to make sure that the correct account is being credited as even sometimes your connecting flight could "auto" change your FFP. You can never be too careful these days.