What email service do you use? Can you check your login/logout histories or IP Addresses? Gmail allows this, but I'm not sure about others. Clearly this person had access to your email as well, to confirm the withdrawals.
good point!
I only searched for email not for logins. The only problem is that I access from three devices but I'll investigate.
I know that IP geolocation is not accurate but according to Google I have had an access to my gmail account from France 12 hours ago and one from Romania one day ago (two country I'm obviously not in).
Just thinking out loud. Some banks have region restrictions on payment cards. So for instance if your details are lost, they can't be used in say Asia. Not sure if google has such features on Gmail, but limiting usage of Gmail to say only a certain country, or even a whitelist of ip's might be a good idea. Not sure if that kind of stuff even exist with gmail.