Originally Posted by DFWsakp

Actually it's not odd. If you would log into my account, you will find only 20,000 points available. But, I have 15 reservations using 500,000 points (award stays). Thus, if a hacker wants to drain me of my points, he/she first needs to cancel my reservations and then use those points for Gift Cards etc. They also normally don't know whether a reservation is paid or with points until they dig into details. If I was hacking, I would probably just cancel all reservations in one go.
But again it could be someone who he know who could have done it.