I assume there was a short time in between the OP's account being hacked, and then the award ticket booking, and the actual flight? Alaska could add some additional check in case of awards being booked for someone else than the account owner within a short time frame. And also have text message verification for any change made to the account to make it very difficult to circumvent such a check.
BTW: which credit card was used for the booking? If not the OP's card in the account, that should make it easy for Alaska or law enforcement to trace who did this. Though AS should already have the name and passport details of the travellers.
Actually thinking about it, just sending a text message in case miles are used (and make it only possible to change the phone number by confirming via text message) would allow early detection.