Keylogger. Simple. You do not understand how Blockchain.info works and you should not make frivolous accusations, if you don't understand how it works and you really care about your "security" (while still getting keyloggers/viruses) you should probably get an offline wallet.
Except that the offline wallet can't be on the same device if he has a keylogger - it would be compromised too.