Under what conditions could a change address immediately send the entire balance to a third-party address? I have a situation where I sent 1 coin to and address I own and my wallet sent the unspent output to a change address but due to a glitch in the wallet software, that change address doesn't show up in my wallet. I did see that change address in my wallet at some point in the past but when I upgraded the wallet, the address was gone. When I look at the unspent transaction, I see that it immediately flushed the entire address to another address that I think I do not own. I do not have my private key and cannot seem to reproduce it from my 24 word BIP32 mnemonic.

Questions:


If I own the private key to the change address, then how could the change address spend my coin without my private key?
If the wallet doesn't identify the change address as being owned by me, does the miner take the balance? 


I'm stumped by how and why this happened.

Thanks
Generally, this should not happen. The situations this can happen should be limited to:


bugs in the software
malicious acts by the software


to resolve this you will need to look up the transaction on a block explorer and document all relevant information, including the block height, transaction id, inputs spent, target address, change address and possibly the miner that relayed the block.

armed with this information you then reconfirm in you wallet and doublecheck for deviations, and if necessary contact the developers of the wallet.

if they cannot help, you should at least be able to ask new and more precise questions here afterwards.