This is the only option from your list that can explain why different funds were sweeped at the same time with OPs funds.
Isn't it possible a hacker just spent his other money along with OP's in one transaction? Or that their office had malware all across the computers and there were more than 1 employee who used bitaddress?
Could this indicate something larger, that Bitaddress itself could be compromised?
I mean, that's exactly what happened to BitcoinPaperWallet several years ago.
Yes, but don't the administrator announces compromisation afterwards? Isn't that what had happened with BitcoinPaperWallet? There is no known bitaddress compromisations as far as I'm concerned.