If that's the case, how was the same address used again? Even if it's the same user, that shouldn't happen.
It seems like you are assuming that OP is telling the truth about using the exchange he mentioned, which made the mistake of giving him a reused address. Let's say he is lying about that, and he had multiple accounts that he used on Rollbit and ended up withdrawing from those accounts into the same ETH address. It's a totally different story then.