and he used " mycelium Wallet " on an Android phone to import the private key and send bitcoins - he did it all the time.
Is the Android phone still intact? Assuming it's not virus, bug or hacker fault, one possibility is Mycelium send remaining Bitcoin to change address (which generated by Mycelium).