Assuming password theft/guessing is the cause there is no good reason for Alaska not to notify account holders of redemptions and/or changes to their contact information via the text and email they had on file. This is trivial to implement and notifying the account holder is not only good practice generally it would substantially eliminate the problem immediately while the airline works on improving security.