I refuse to think that the coins were taken from a bot, given the fact that the replaced address took place only after like 45 seconds which is very very quick to crack and broadcast to the network.

But what i think that 0.66 BTC were taken by someone unknown since they transacted like 10 mins after

it could be that the winner is the creator himself.