FFHKG.
Whilst you may be correct, you have not stated that the credit card used on the BA website has not been used at any time before/since for any other transactions.
A bit of leap to come to the conclusion you have done.
As suggested above, if you think BA was the source, the appropriate action is to inform them and request they investigate.