1. Hacked SEED: Because even with remote access, the hacker can't still decrypt your wallet.
Where did you keep your electrum SEED? in your email, cloud disk or local disk?
I don't think the hacker had full access to OP's computer, being hacked by a trojan or something like that is unlikely IMO.
It is so much easier to just get the user SEED on a gmail draft or something like that.Most people do not hand the seed with proper care.
THe hacker could have got access to the seed long ago and he was waiting the wallet to be funded....
Anyway, I wouldn't be so sure about that remote access from the hacker, unless if there is some evidence of that.