The use of the same LTC address(Lf3H5K7g6yGZGFNSd23zMZ36kvV7GkT8b3), on 2/18 and 3/9, makes this case fairly damning.
I cannot image why a scammer that stole the phone would provide the same LTC address as the original owner.
Need an answer for that one..