My email was changed to some Russian account. But they notified my normal email account. Petropoints are absolutely terrible at fixing this. I had to phone and got cut off, with no hope of getting back. This was one of my many accounts with my default password which is somewhat guessable, with a lot of effort, or an even older account was hacked.
In the past months I have changed all my accounts to something random from a local Java random password generator, and used Google Smart Lock. I recommend this to everyone. However, there are still accounts floating around that I hardly ever use. It would suck to lose all my petro-money, probably about $30.
You must assume that lost accounts have been hacked because nobody defends them any more. Change your passwords!
ps. they changed my email to 'proton.com'. I suppose they have to go through an effort to get my points. I informed the owner of that service in Malaysia to remove the offending account (they are probably majorly hacked). I don't expect a good response. :)
pps. confirmed that they took out $25 by using The Bay. Wow, they used a number of companies.