Yes someone has setup a bot to automatically sweep coins sent to the demo wallet. It doesn't really matter if I change the addresses nobody should send funds to any addresses in the demo wallet as anyone can spend them. I will add a warning popup if someone tries to copy and paste an address from the demo wallet.
I recommend you to delete this addresses from the demo-wallet and to leave only watch only addresses. Isn't it better?