It’s really impressive no one caught their three previous private key values

I suspect they did but it wasn't publicised.