Ethereum instantly transferred after receiving

Hi,

My friend and I recently started working for a company, we got a small pay today. I received it normally, but when my friend received it, 3 min later it was out of his wallet again to another address.

Why is that? Can we get it back (I guess not) ?

His metamask has a 32 char generated password.

​

This is his wallet: https://etherscan.io/address/0x0490A9ffb29108D8238A63A040F01d994cfD4bf2