Already contacted that sponsor about the hack/issue?

They would have all that affiliate's info to act on. They won't tell you anything specific but they should be concerned enough to investigate the circumstances of the "hack" and if determined true:

To close that affiliate's account and forfeit his earnings -- that is a standard affiliate termination forfeiture action cause ... It's in the contract "fine print."