They might be within their rights to take out the points but it sure is the incorrect thing to do from a customer service standpoint.
I do realize that there are likely very many situations similar to this that add up to considerable amounts of points for AE however could you imagine if any of our company's came back 3 years (heck even 3 months) after making a billing mistake and demand payment?
I have learned in business that if I make a mistake we honour it and move on. Upsetting your customers after the fact is no way to build loyalty.
I imagine that AE stands to loose a lot more than 12,000 miles from galambo in the future as he might opt to earn points from other airline partners which AE would have sold to say a hotel or car rental company who would then pass them on to him. 12k points is not a big deal in the big skeem of things especially if he is a status member and the potential of 10's or 100's of thousands lost points AC could have sold to companies who galambo deals with on his behalf. Heck 12k is only 24 hotel stays of 500 points each which is nothing for many of us. Now just think of the lost revenue of galambo held a AE earning credit card and he gets rid of that.
Short term thinking on AE's part imho