All withdrawal steps, including its final confirmation, are done in the user panel, so if someone else has access to your username and password, they can do it.
We suggest that you take the security of your account seriously and change your password regularly if possible.