There is no guarantee that the guy actually stole his BTC. Many wallet stealers won't take the funds right away but will wait until a sizeable amount is transferred into the wallet before it cleans it out.
This is what I am talking about. There is 90% chance that he did stole btc from OP, but still 10% chance that he did not. There is no strong evidence.
I would say even less than 90%.
Evidence supporting this person was the thief:
- He had unrestricted access to the computer.
- The funds were transferred almost immediately after he left.
Evidence against:
- As Blazr mentioned, wallet stealers often wait until a significant amount triggers them into action and this address hardly had more than half a bitcoin in it before the day in question.
- This person should have known that he would be the first suspected and that his victim could easily track him down.
so he's returning the card out of the goodness of his heart and despite the fact he lost not only what he paid for the card but also money from his own wallet.