Sabre PNR's do actually remain the property of the carrier whose partition they are booked in, i.e. - American Airlines, in this instance.

Yes, data is shared with other carriers and ground service vendors, however, this data is actually structured data held within various data fields within the PNR. For example, if a PNR is booked in Sabre but includes BA segments, a BA agent won’t see all the 'Remarks' field data in the Sabre PNR. When the corresponding PNR is retrieved in Amadeus, the Sabre remarks data isn't visible.

In addition, airlines and travel agencies on Sabre can employ Sabre Global Security, to inhibit viewing of certain parts of their PNR's. Perhaps if expertflyer.com had used this feature of Sabre, their AA access would not have been revoked.

Finally, I'm pretty sure there's something in the Sabre agency contracts covering dissemination/distribution of data to external sources, so they may also have violated their Sabre contract. Can't say for sure though of course, without seeing the Schedule A and entire contract....