So, I was all ready to jump in with "it's a scam you fool - we've had three threads on it already!", but this one's obviously legitimate so I'll save that for another day

Are all of your accounts in the same name? I mean absolutely identical. No abbreviations, etc? Perhaps they incorrectly identified the rogue transfer as a transfer between people rather than just between accounts owned by the same person?

In the absence of a hack, and taking your claims of innocence at face value, that's the only thing I can imagine would have triggered it

Keep us updated, won't you?