I’m really amazed how stupid these scumbags are. Get the keys reprogrammed and see if BMW NA can get the dealer to put an alert not to copy the keys unless they call you or request some kind of identification measures
You can also disconnect the battery so they wouldn’t be able to start the car.