He typed the private key into his computer to send some bitcoins out of it and a few hours later the rest of the funds on the paper wallet were stolen.
How is this even possible, the funds belonging to a private key needs to be spend all at once right?
No. You need to "spend" all the funds in each input that you are sending however it is possible to make the chance go back to the address that originaly had the funds as is encouraged by the use of paper wallets.
It would be possible to have multiple inputs to an address and only spend one or some of them.