You're right, he changed the withdrawal address to random. Just tried to request deposit on the 1st account 40 times and always generate new addresses and do the same for the 2nd account and both of them don't have the same address.
But he forgot that the privkey should also change every time it generates a new address so it won't be too suspicious.

I just realized there is a joke exchange account that provides up to 40 deposit addresses with one privkey. Haha

Oops, he just launched an airdrop program using another account.
https://bitcointalk.org/index.php?topic=5287075