The victim's fund was sent to bc1qq0aheutystzzw4vc0kn5fkuvnp54ju3yckpmww. Am I getting you correctly?
If so, there is no outgoing transaction from that that address at all. The address has received 0.08949505 (which is around $3,100 worth of bitcoin, not $7,300) in the transaction in question and 0.20808782 in total, but hasn't spent any fund.
OP's story doesn't make complete sense. It sounds like a scam of sorts really did happen but I don't know how he determined that bc1qq0ah... is the scammer's address as the funds were sent to 18 different addresses.
If the thief had TeamViewer installed on the phone, I don't think they'd need the OTP to make the Coinbase withdrawal... They'd be able to see the incoming SMS, or open the authenticator application.
The "drained" addresses are associated with a wallet that has transactions going all the way back to Aug 2012, so it appears to actually belong to Coinbase.