Normal part of my morning routine is now:
* logon to Marriot account
* check to see what reservation somebody has made and attached their 2nd email and name to
Thankfully the Marriot people have been helpful in returning my points.
But nobody seems to know how it's happening (my account password has been changed; my account has a PIN)
I asked if I could transfer to a new account to ditch this one and they said sure.. they'd just need proof of a mailing address via a drivers license.
I best just use my points ASAP and then ditch this account myself.
Lucky for me, no credit card was ever added to this account. Phew!