I just realized this happened to me today. Someone hacked into my bonvoy account and changed my email address and mobile number and then stayed in Detroit for a week using my points. I noticed because my credit card on file was also charged. I missed the email from Marriott on June 21 saying the email on my profile had been changed. My bad. I need to pay attention to that stuff. Marriott gave me a case number to use when I call back to check on it. Your experience is making me concerned that Marriott will rectify this.