That address 1EJcTLZNfy9HALtgovGuUJbLi1ERmoo6uZ seems to steal more:
Public Note: yesterday you hacked my account and took $9000. i'm in seriously danger of physical harm right now. i only need $7000 to pay off the debt. can you please send back $7000 and keep the other $2000. please help. i need the money more than you do right now.
And you can indeed see a 18 BTC transaction before that.
So I do assume his story is true.
My guess again is someone who hacked another website, stole the database and matched the hacked emails/passwords to the blockchain.info wallet.