Well, I am not a big fan of Microsoft's business operations, but I do have to say that this is still stealing.
Truthfully I think Microsoft should ban all those accounts permanantly and lock the people off XBL based on personal information and so on.
Of course 1.2 million dollars at 160 points a pop probably represents a lot of users, and Microsoft might be concerned that perma-banning/locking out that many people would wind up costing them too much money due to the loss of their general business.
It's situations like this that make me think that the game industry needs a universal black list for enforcement purposes. When things like this happened, a person not only gets banned from the network on one account, but banned as a person based on information from their credit cards (real name, etc...) on all gaming networks, for life. I think as a deterrant it would solve a lot of problems, and wind up saving more money, time, and trouble than they would lose from the lost business.
See, with some of the behavior that goes on right now, banning people is fairly trivial. The really obnoxious cheaters, thieves, and troublemakers are the kinds of people who are likely to just go and plop down the money for another account/console and pick right up where they left off. $300 is a lot of money in most cases, but if this is how these guys derive enjoyment, it's just part of the cost of doing "business". Besides, when you consider that we're dealing with the mainstream now, there are plenty of people for whom $300 is nothing. People keep talking about the annoying "frat boy" types floating around out there, but understand that kind of low-IQ, privleged, annoying dweeb probably blows that much nightclubbing or simply on weed and booze on a regular basis. Microsoft bans his X-box? That's simply a trip to the store, or a call to daddy for more money away.