It's easier to conceive of BitCoin as a system of bank accounts, where your balance is saved on your machine and on peer machines in the network. The "coins" (.dat file) on your machine gives you the right to reduce your balance (ie spend money) but making a copy of that file doesn't mean there are two sets of coins floating around, because the balance is still only in one account. All you have is two people with the rights to spend the money. In this case the thief transferred the money out of the victim's account into his own account. It was a Windows machine, connected to the network, unencrypted, his friends knew he had lots of bitcoins, he kept it all in one single account...there are many layers of user error here. PLUS the ever present possibility that he's a troll keen to push the price down.