The fact that it wasn't all moved today does not mean it isn't related. The theft was due to a leak that happened over a long period of time. The transactions to this address start in April of 2012. That is entirely consistent with the theft. 740k worth of transactions in one day would make it a less likely candidate for being related.