Basically an old and forgotten PP a/c. Baddies depositing from RU's account-linked card and immediately withdrawing to baddie-controlled account without PP's computer raising an electronic eyebrow.
Read the thread at:- https://www.reddit.com/r/UKPersonalFinance/comments/1mcqc43/someone_hacked_an_old_unused_paddy_power_account/
And follow the good advice given about not using the same passwords on different accounts, or close variants because the bad guys know to try adding 1 or 2 or 3 or...
It looks like between the bank and PP, RU will be no poorer but hopefully still wiser.
purple wouldn't let me withdraw to my own card the other day until I lost some more bets and then deposited some more. So yes an eyebrow should have been raised.