This is how Bitcoin works: anyone with the private key can move funds. The only thing that's left now is find out how the private key was leaked, and make sure it never happens again in the future. Considering the funds involved are quite significant, they should only have been send to a cold wallet. Hot wallets are inherently risky.
I know, I was just wondering how it was possible to send a Tx that was spending unconfirmed deposits (i.e. with 0 confirmation).
I don't see a problem as long as the first transaction is not changed.
A to B, transaction unconfirmed but you can still send coin from B to C.
However if the transaction A to B is changed like canceled (double spend and fees increased too I guess) then the 2nd transaction which was from B to C will drop.
Risk is someone can easily scam someone else who know how to drop B to C.
They will send a transaction from A to B with lower fees, obviously it will take much longer time to confirm. Then they will do the 2nd transaction from B to C.
Consider it's a P2P exchange. The buyer (BTC buyer) send the other currency that you two agreed on. His received bitcoin transaction is still unconfirmed but if he send the other coin and you decide to change the first transaction which was A to B then the transaction B to C will disappear and your buyer will never receive the BTC unless you send him the BTC again.