There is no way this can be right. If that was a true random hex number with that many digits there is no way it could be cracked easily. Can someone else input on this?
The second and third accounts had no 256-bit public key (no transactions out) so someone possibly could have accessed them via a collision. As someone else mentioned though as all three accounts were accessed (basically at the same time) it may be more likely he has malware on his machine.