I've always been concerned about the lack of security with AA.com concerning easy PNR lookup. I've seen a built-in error message if you book travel online, and then from a public location pull up the record without logging in and attempt to cancel it.

So, I decided empirical evidence would be the best method to answer your question.

1) I called up the Exec Plat desk and had them place an itinerary on a 24-hour hold.
2) I then proceeded down to a public computer lab, with record locator in hand, and pulled up the itinerary.
3) Without logging in, there was no Cancel button available, but it looked as if I could change the seat assignments.
4) I then logged into my dad's account, and pulled up the record locator from my dad's account.
5) The cancel button was there, but upon hitting it, I received the following message:

Check below for errors:
We are unable to process your request because you are not listed as a passenger or did not purchase the reservation. Please contact your local American Airlines Reservations Office.

In conclusion, it looks like the individual may be able to change your seats online, so I'd watch that, but as far as cancelling your itinerary online, I think the functionality is pretty well protected.