I don't mean to accuse, but this pattern of activity is a bit suspicious. Maybe you can comment on it? What type of activity is this?
<...>
Judging only from what has been shown, it appears you may be on the trail of something here, but it's still just circumstantial evidence. Have you already checked if there are any connections in token transactions between their addresses?