My first suspicion would be that your browser was somehow tricked into sending the HTTP requests needed to withdraw the coins to that address while you were already logged in. Either by some clever hack or because you clicked a link you shouldn't have.
a web browser getting tricked this is interesting.... so is there a way of avoiding this happening to someone else, because peoples funds have been hacked not only on localbitcoins but paxful as well 
and so called hack happens during a trade.