EDIT: Additionally, It may be bounties paid for work (such as media or the block explorer) that were only recently deposited and came from the original premine.
I had thought of that but those bounties would have been paid months ago. The 5k I saw was moved the 11th of April. Just a few weeks ago after the announcement of dropping support for the coin.
Shit man. I'm just happy you are posting. Please prove everything I've said is wrong. I will take no hard feelings from it.
The 5000 AIR tranasaction you identify happens on this block:
http://explorer.teamaircoin.org/block/9d80c5a288e4c33cb014274260bca2f32e3aee0ac81f676f286622f5898c0be0There you can see the address that the 5000 AIR was sent from: "AeNa12D2kT33GVqTvBHVBg3wGtCdyj75ic". This is a deposit address for Poloniex, where we have deposited the premine for use in the market making algorithm. Only deposits should be made to this address, our team has not withdrawn any of it. This reduction of 5000 is, shockingly, not reflected in our balance on Poloniex. It is possible that Poloniex may break up large sums into "chunks" of 5000 AIR at a time for their internal recordkeeping.
This means that the transaction must be a move from one poloniex wallet to another poloniex wallet, both of which are tied to our main account. If we withdrew all coins from poloniex, it would likely send that 5000, along with all of the other coins, back to our original wallet. We will be doing a withdraw soon, along with a second check over our premine storage wallets, to confirm all of this.