I would tend to fall on the presumption of believing these coins were not stolen by an outside hacker, as a more typical scenario in these cases is an inside job and than a manufactured story of guilt which is an old grifter ruse.

At this stage in the game their should be 2 rules with mining hardware.

1) Only use multi-sig escrow with a trusted arbitrator
or
2) Do not preorder equipment and pay with a credit card or use option 1 if its an untrusted company
and
3) Refuse to lease cloud mining!