- Someone acceded the 24 word seed in his email draft, and since he only altered the position of a few words, perhaps he just swapped the first for the last (really swapping two words, not three). That would be the first option one would try, aside from reversing all words. If only 2 or 3 words were switched, the number of combinations to try is drastically reduced.
This seems like the most likely scenario considering he apparently put it in an outlook email and this happened a few months prior:
https://www.wired.com/story/microsoft-email-hack-outlook-hotmail-customer-support/The gap in time between the email hack and the movement of funds may be explained by the hacker trying to brute force the proper order of words. Either way, he broke the rule of not keeping a copy of his seed online, and he sadly paid a lot for it. I hope people out there who still do this despite all the warnings can learn from his mistake.