Shop with Points – Missing Credit Card Rewards

Not sure if anyone here will know how this happened:

Two weeks ago I noticed that all the reward points for one of my credit cards was missing (>50k points gone). Found a page listing my redemption history and it listed all the points be spent across 10+ purchases in rapid succession. Each purchase was 50-100$ of points, through Amazon. Other cards with the same bank were unaffected, and there were no fraudulent credit card purchases.

One phone call to the bank and I got the points back since the redemption were so suspicious, and not found on my amazon account (kudos to them for being so quick to reimburse them). However I was left wondering how this all happened...

Amazon: I use 2-step verification and buy things infrequently. I have a number of cards attached to the account but almost never use the card in question. As a precaution I still changed my password, but I don't think this account was hacked.

Email: I use Gmail with two-step verification. I checked for any strange logins or email forwarding but nothing was effected.

Credit Card: this particular card is used for dining, as that's where it gets the best rewards. This also make it high risk for skimming, etc. For now its been canceled, and my bank credentials have been reset.

Looking at the Amazon "Shop With Points" info, it seems that all they need for verification is your credit card info, no bank related login necessary. If someone skimmed your info, it seems plausible they could add the card to any amazon account and have access the points directly: no password or username needed. Is this right? If so, it would explain why the points got taken. Maybe the bank only does fraud checks on actual purchases, but not reward point usage?

Just wanted to ask if this seems like a plausible scenario. I'm having hard time explaining what went wrong, and how to prevent it in the future. A quick google search seems to show this happening before...