I've no experience with crypto but a lot with UI. Is it possible that they were trying to send 500K for 1865 and entered the numbers in the wrong inputs ? Software asked them to confirm. They saw the correct digits and pressed ok.
IIRC, bitcoin transactions are structured to always send the entire wallet balance every time, and the way to avoid doing that is to send almost all of the money back to the current wallet address in a self loop. Then, any money that isn't listed with a destination becomes the miner fee.
So they may have just forgotten to add the field that sends the money in a self-loop, and by default the account was drained by the miner fee.
This is obviously a terrible design but it can't be changed.
I suppose that $1865 is a reasonably small price to send $500k to someone concealed as a service charge.