The first possibility is that the player's account has been hacked. It doesn't have to be a remote attack. It might be someone who knows him because his account logins only show up from Finland. (Same region as the player)
So does this mean that you will not be allowing players to withdraw that use VPN should there be any changes in login history say, I am from Germany and my IP history mainly shows Germany, and I use a VPN and withdraw my funds? I do get the security aspect of this but its best to include this disclaimer on every platform for us to not undergo unnecessary KYC just because we changed location for a single time, especially if 2FA is enabled and we were able to pass it on the login page.
--
As for OP, most of the information you have provided do not carry weight, or it just doesn't make sense from our perspective, the bystanders who watched this thread progress. It is not enough to pin down Slotella as a scam just because you or 'someone' mismanaged your account and the balance in it. For an IT security manager, your internet security is extremely weak, and you believe that because of your experience, you are immune to hacks and other such attacks.