That explains why SPF suspects you.
Did you report this $4k (multiple transactions?) to SPF when you do the report?
SPF only acts on the account when there are multiple reports from victims of UML tied to your compromised account.
UML plays with smaller amounts to "accommodate" to a larger loan ($1500 is considered a large amount to them), $4000 transaction is a figure that UML don't part with easily especially to an unknown account.