I don't know with 100% certainty. I only know the wallet is most likely a HD wallet as that is what
1) readily allows for the type of transaction in question to take place
2) is used by the most common wallet providers where one retains control of their private key (Electrum, Mycelium, Coinomi, blockchain.com, Exodus, etc).
So if either one of those users can present an xpub that leads to only one of the 2 addresses, does that justify reasonable doubt from being the same person, and make it likely one of the private keys was manually imported?