Mining Pool safety question.

Hello members of Bitcoin-talk, I have a question that has been on my mind a while since all these pool hacks have been happening and stealing coins.

The question is: Once a hacker has actually hacked into an admins account for the pool, how does he send everyone's coins? I find it strange how pools say they've been hacked and the admin account has been comprised and the hacker has sent all the coins to their address. Surely the admin control panel doesn't have this sort of option to transfer everyone's balance to their address right? If they do why cause that is corrupted.

Just find it fishy when pool owners who was hacked say that.. since i think the hacker need to get access to files on their desktop such as the offline wallet to send the coins? Im just abit confused on this whole hacking pools scheme, i need to know if my coins are safe from admin controls.

thanks