It could be some sort of virus, I'm pretty sure I've heard of that in the past.

A simple script such as:

If clipboard == -ethereum address format-:
   use -this address- instead

Also, isn't there a better way than to store your ETH online? I wouldn't trust a website even if I created it myself haha.

Wipe your computer, buy a Trezor. I'm sorry to hear about your loss man.