How comes Blockchain.info generates private keys using block hashes or tx id instead of random numbers. Who had the privilege to change the key generation methods?
Nobody said they did.
Maybe it was a hacked wallet, or a key logger running on a computer whee the transaction occurred.
According to the facts of the OP I think it is safe to say that this was a dev of a company which implemented it into the code.
A malware would act different (f.e. Hardcode priv key's so nobody can recognize it)