It is possible that the hacker collected various private keys via the hacking of multiple computers and then spent the BTC all at the same time. This would be the expected behavior if the hacker does not have a script to automatically spend/sweep the btc contained in the private keys stolen.

if however the addresses can be linked together from previous transactions then it would be more clear that these accounts are in facts alts of the OP.