Why did a burn address have outbound ERC20 transactions?

While compiling a list of known burn addresses, I came across an interesting one:

0x0000000000000000000000000000000000000DeD 

According to Etherscan, NMR have been removed from this address on two occasions. Both appear to be a call from some other address to the NMR ERC20 contract's withdraw() method.

My theory is that NMR has some sort of nonstandard "unilateral withdrawal" functionality which doesn't require an approval. If true, that seems alarming. Can anyone explain this behavior?