That's wonderful. But they should also be sending texts since notification is real time. Also putting a hold until you call in on reservations that look suspicious and flag with an email & text to the existing address/phone whenever there is a request to change either of these or other contact information.

This is trivial to do, will dramatically reduce the problem and unlike locking accounts after the fact doesn't inconvenience anyone making legitimate bookings.