Under what conditions could a change address immediately send the entire balance to a third-party address?
Generally, this should not happen. The situations this can happen should be limited to:


bugs in the software
malicious acts by the software


to resolve this you will need to look up the transaction on a block explorer and document all relevant information, including the block height, transaction id, inputs spent, target address, change address and possibly the miner that relayed the block.

armed with this information you then reconfirm in you wallet and doublecheck for deviations, and if necessary contact the developers of the wallet.

if they cannot help, you should at least be able to ask new and more precise questions here afterwards.