You have a point here. My first reaction was that it wasn't anything to worry about, but then I tested the theory on my reservations and now I see the point.

On AA. com, if you have the record locator and name, you can change the reservation etc with no additionall log on required. Maybe that changes if the PNR is password protected, as in your case. But that would not have been true if you hadn't called.

Seems to be a gap in security.