Here's what might have happened:
- bitaddress.org was compromised at the time you used it (quite unlikely, it'd have been announced later).
This is the only option from your list that can explain why different funds were sweeped at the same time with OPs funds.[/list]