I am very sorry for your situation, it must be an awful thing to be going through.
However it is not a security breach. A breach implies someone has hacked your account or their systems, which is not the case. Him having your surname and booking reference is the same as you sharing your username and password for something. No doubt you've had a lot on your mind and these joint bookings were not the first thing you had on your mind, but the outcome was there waiting to happen.
As others have said it is pretty standard protocol and it is convenient e.g. my wife often books flights and leaves me to deal with details of seat selections etc.
It would have been decent if QANTAS were understanding of your situation and helped you out, but it is hard to find someone in a call centre anywhere that can work outside of the standard script. Maybe you can find something in the domestic violence snippet someone posted earlier, but otherwise I would cut my losses.
