Someone Used My DeFacto Account and Points but I Never Asked to Close It

I was surprised to find that someone had placed an order using my account and my reward points, sending it to their own address and phone number. I have no idea how they were able to do this, so I contacted customer service to cancel the order, restore my points, and investigate how this person was able to place the order. They informed me that the matter was under investigation and that access to my account was temporarily suspended. However, I later found out that the order was delivered, and I received a message about it via email. When I spoke to customer service again, they told me that my account had been closed at my request. But I never made such a request — all I wanted was to find out how someone was able to impersonate me and place an order through my account, and to cancel the order, not the account.