The first possibility is that the player's account has been hacked. It doesn't have to be a remote attack. It might be someone who knows him because his account logins only show up from Finland. (Same region as the player)

We checked the password change actions for this suspicious process. According to an IT security expert, the player's password is something like asdasdas. I really don't find it logical.

If you have such a large amount in a casino account, your account password should be stronger(instead of asdasadas) and you should enable two-step verification.