and you said it a further two times before Alaki then said he had the Private Key in his email folder, which, the hacker somehow also gained access to.
If private key was used by intruder to sweep bitcoin during Account compromise, then who the hell used the same address in the locked alaki's loan thread long before?
Can you give a link please? and / or a TX for the transaction?
Sometimes a scammer will create fake transactions to give the appearance that they are doing more trades than they really are.