I just went to the AAdvantage gift-card website, and all of the Sephora cards are virtual, so presumably they were sent to someone's email address.
I might also contact the vendor who operates the AAdvantage gift-card program. Perhaps they have a fraud department.