I rememer a story on FT of a guys NWA account being cleaned out by a stranger that redeamed his miles and used them. When he contacted NWA they said tough luck you need to sue the criminal.
So did the criminal defraud the passenger or did the criminal defraud the airline and then the airline defraud the customer?
I tend to think the latter is the answer but I'm not positive. I liken it to when someone cleans out your bank account the bank must take responsibility fr failing to properly identify the payee.