There's a possible explanation for that. They stole from an old copy of your wallet. Since then you've sent coins to other people (normal spend transactions) and the change has gone to new addresses (and corresponding private keys) that are not present in the old copy of the wallet that the thief has. So consider where you backed up your wallet in the past.