Supreme negligence on his part. He knows his server was accessed, but he didn't transfer the coins to a new address.