Yes that is the address that seems to be hacked.  I have a lot of systems that send to that, would be hard (not impossible) to change that on all the equipment.  This has been going on now for a week or 2.

And yes, it takes the whole balance every time.