If it were me, I would change all my identifying info, my phone number, card number, address, email address, and secure my account with a call-in password. I would probably inform Amex that there is a security issue with my account and want them to only give access with a call-in password. Would do legitimate spend, make the necessary points, use it, and then figure out with a Rav how and what to pay the people who opened these accounts.