If someone books flights for themselves on a hacked (compromised) account, doesn't that expose their identity and make them subject to prosecution?

Even if not booking for themselves, the beneficiary would have to at least know the culprit, I mean hackers don't just book flights for randos in an attempt of ill-advised charity.