I'm looking at my on-line statement and it says "miles expires after 36 months".
My last activity was May 05. The first I heard of the new "policy" was an email about a month ago.
Legally, they can probably do anything they want. But I think it's a major PR blunder to make miles that would have expired in May 08 expire 18 months earlier.