Relayed by ip: Blockchain.info - does this not mean that the hacker's IP has been relayed by a provider known to Blockchain.info?
"Relayed by ip" is the ip of the node that relayed the transaction to blockchain.info. It is not the originating node. However, in this case since the relaying node is blockchain.info, it must have originated there, and that means that the thief probably logged into your account to steal the bitcoins.