It is possible that the hacker collected various private keys via the hacking of multiple computers and then spent the BTC all at the same time. This would be the expected behavior if the hacker does not have a script to automatically spend/sweep the btc contained in the private keys stolen.
if however the addresses can be linked together from previous transactions then it would be more clear that these accounts are in facts alts of the OP.
You mean apart from the proof previously linking those wallets with various users here that caused them to get negative trust from various people?
Is there another transaction that links those addresses together?
That's a good question... As to a previous comment of yours; there's definitely strong, similar language being used by all the accounts I've listed, especially claiming people are trolling or spamming their threads once the red paint cans are lined up.
Let me know what you find, I'm off for a little while.