Sorry, but there is a lot of law about this beside just the contract terms. First, the contracting party did not cancel their trip so the cancellation clause doesn't operate, and the operator is in default for having taken the client's money and did not provide the service. That is breach of contract and normal breach of contract laws apply. That womeone fraudulently canceled it for them, on line, takes perhaps some blame off the seller, i.e. it is breach of contract and not bad faith. But the seller also created a riks by allowing such transactions on line and having no system in place to assure itslef that the seller was dealing with the legitimate party. That is negligence on teh part of the seller. and he cannot shift blame to the client who did not cancel the trip. Under such circumstances as these the seller should have immediately provided a full refund including any airline cancelletion penalties or fees.
And if that is not good enough then there is the equitable principle of frustration of purpose which operates to void a contract and return all payments to the purchaser.
“You are solely responsible for maintaining the confidentiality of your password and account, and are fully responsible for all activities that occur under your password or account. It is also your sole obligation to immediately notify Carnival of any unauthorized use of your account or any other breach of security,” reads Carnival’s cruise contract.