To correct some information:
He didn't touch the phone the day before when he found his wallet had vanished. So it is clear that someone uses his private key. the moment when the coins moved his phone was OFF.
Even with that, it is still possible that he accidentally "
sweep" the paper wallet's private key to another wallet.
4033ac94f79db922d327d82f154d686194ed54cded3b2221340484c09421e7bc had sent
all of the available UTXO of that address that could mean that it was swept.
It's possible even without opening Mycelium since it's the private key that's swept.
My guess is it's still in one of his forgotten wallet with "
sweep private key" feature.
Those newer transaction's input was from a newly received transaction
after that incident:
- e8a181a2728d7034904b33881370bdf5405e73d7180b028211ed9b9b414fb9a1 - received 0.006 BTC
- change of b69ac4b06ce76e3144271e7017ad37aec8916bdc7cf77ac17541e075290a1120 - 0.0050761 BTC
Plus, if it was stolen, it should be spent by now.