I read someone’s story yesterday about their American AAdvantage mileage account being compromised. Someone changed the address and email address on their account, and proceeded to book Cathay Pacific first class awards for someone else using their miles. They managed to catch it before any of the flights were taken.
This can happen to anyone, in this case the person who did it clearly obtained the account password. Changing the email address meant the accountholder wouldn’t get a copy of the tickets being issued, or mileage statements showing lower account balances.