If this address does belong to the thief, why would they steal all the bitcoins with a single address? Surely using different addresses would make it less suspicious
I don't necessarily believe that this address was related to the theft, only pointing out that the expectation of one transaction containing all the stolen bitcoin is not correct. Yes, using different addresses would be less suspicious.