Maybe I'm just reading it wrong but it shows only a 27686.025211 balance at the time of theft but the transaction details say 28k or so were transacted.  Looks like it may have been taken from some change addresses too that he didn't post.

I retract my statement