It's recently been suggested that it actually is possible to drain someone's wallet using transaction malleability, if they are not using the reference software. See below:

https://anders.io/the-troublesome-history-of-the-bitcoin-exc...