IIRC, bitcoin transactions are structured to always send the entire wallet balance every time, and the way to avoid doing that is to send almost all of the money back to the current wallet address in a self loop. Then, any money that isn't listed with a destination becomes the miner fee.

So they may have just forgotten to add the field that sends the money in a self-loop, and by default the account was drained by the miner fee.

This is obviously a terrible design but it can't be changed.