Things will get quite interesting once full RBF becomes commonplace. Any such transaction stealing coins from a brain wallet or leaked private key could be replaced by another transaction, regardless of whether or not is opted in to RBF. We could end up seeing different bots broadcasting more and more replacements, each paying a higher and higher fee, trying to steal the coins for themselves. Since there is no incentive for any one such bot to surrender and let another bot win, then such transactions could just escalate until the entire value (or close to it) is paid in fees.

You left out the last character. With this added, the signature is correct.

That's going to be interesting if several people claim to be the real owner. In that case following the coins up the chain and signing a message from one of the earlier addresses will be more convincing.

---

---

My take on what happened:
Address bc1qn3d7vyks0k3fx38xkxazpep8830ttmydwekrnl received funds, which were immediately transferred again. That happens to every compromised private key, and many bots must be competing to be the first to steal funds. Usually, they use a high fee. In this case, my guess is that since more and more nodes accept full RBF, this lead to a very high transaction fee. Eventually, miners will get all stolen funds and the "private key hunters" will only be left with crummies. I hope the real owner can convince Antpool he's the real owner, so they don't send it to any of the private key hunters who also have the same private key.