Take any address that's been paid out and get it's deposit address from the web form. Match the deposits with the payouts. Now it could be just them passing coins threw their own system, but it seems like a lot of miner fees that would add up quickly.
If many ppl do this regularly then any funny business would be spotted. Perhaps I should offer a bounty?
I learned the hard way that the my investments is tied to the current cookies, if you wipe your cookies then they are gone forever.