To make sure I'm reading this right: you are saying someone steals the key envelope. The guest in that cabin sees they have no key envelope, so they go to guest services and tell them they had no key envelope. Guest services makes them new Sail & Sign cards. The guest then goes back to their cabin, opens the door with the new key, and drops off their carryon. They leave. The thief has been lurking in the hallway this entire time, sees them go in and then leave without their bags, then uses the old, stolen keys to get in the cabin and steal the belongings inside.
Now, I work in a hotel, not a cruise ship, and even with our less sophisticated keys that are NOT tied to an individual's spending account, this would not work. When we issue keys to an already checked in room, we can make duplicates, so all keys we have made for that room still work, or we can make NEW keys, which, when used on the lock, transmit a new code which voids out all previously made keys so they do not work anymore. I am 100% certain that every time a guest reports to guest services that the envelope with their Sail & Sign cards is opened or missing, the GSA makes entirely NEW Sail & Sign cards and voids the old ones so they will not work on the doors and flag as compromised if the thief attempts to use them to buy anything. In the above hypothetical scenario, the thief could not use the stolen keys to get in the cabin after the guest had used their newly issued keys to enter. It's impossible.