The second and third accounts had no 256-bit public key (no transactions out) so someone possibly could have accessed them via a collision. As someone else mentioned though as all three accounts were accessed (basically at the same time) it may be more likely he has malware on his machine.