Everything pretty much ends up in this account if you follow the chain

https://blockchain.info/address/1N2f642sbgCMbNtXFajz9XDACDFnFzdXzV

and now he's taking everything out of that one too..