ETH address with 35 leading zeros transacting?

I've noticed several addresses receive AND SEND tokens in Ethereum which have an uncomfortably large number of leading 0s.

[1] I thought all transfers had to be signed by a private key that corresponded to the Ethereum address owning those tokens? The address in question doesn't appear as a smart contract on etherscan, that's why I'm not sure how this happens.

I'm sure I'm missing something about my understanding of ETH, I thought all addresses that could spend their ERC20 token balance, had to have a valid cryptographic signature coming from a private key that corresponded to their the public address.

[2] Could someone give me a brief explanation of why this address is able to send the ERC20 token NMR, out of its balance?

Address in question:

0x0000000000000000000000000000000000028Ae8

Token transactions:

https://etherscan.io/address/0x0000000000000000000000000000000000028Ae8#tokentxns

[3] Additionally, I would like to know what is the longest vanity address that has been found to exist which was generated via brute force or a clever vanity address finding algorithm.