The sender had 0.10494256 BTC in one output on address 1CKnhZmHzj45xdvvsAf3DbLWfYSX53NVMs. This output already had 100+ confirmations.
He made an initial transaction to OP with TXID 2f362caac5d3fa3a1cc586f5bdbb36bcfe6446cfc112eb1cb097d9669688204a, which spent that output with a fee of 1 sat/vbyte.
He then made a second transaction with TXID 31c444900939113ad1c57277fc2904b20f77e57f76f95eee45ec119e72a6342c, which spen the same output to a different address (presumably his own) with a fee of 20.2 sats/vbyte.
When I responded I did not check the tx but explained the possibility now I see the tx history of that address (output address of the sender).
Tx in question is this: 2f362caac5d3fa3a1cc586f5bdbb36bcfe6446cfc112eb1cb097d9669688204a
and this tx has OPs address 34Y9ZwTsT3H9zcnffirc2NM4XMkNmaLws6
Then the sender somehow removed the OPs address and replaced it with this address 1HrtBS3eM1wG7UKuP39fqnRQVX6FJvc8An
And used higher fees. The tx is 31c444900939113ad1c57277fc2904b20f77e57f76f95eee45ec119e72a6342c
In both cases the change address was the same address as the output which is 1CKnhZmHzj45xdvvsAf3DbLWfYSX53NVMs
First tx (2f362caac5d3fa3a1cc586f5bdbb36bcfe6446cfc112eb1cb097d9669688204a) had less fees and had this address (1CKnhZmHzj45xdvvsAf3DbLWfYSX53NVMs) as changed.
Address 1CKnhZmHzj45xdvvsAf3DbLWfYSX53NVMs has unconfirmed coin, and he went to spend that unconfirmed coin. Once he made the 2nd tx then the first tx was effected because it had its input and output same address. And as a reason the first Tx dropped?
I never experienced that but the dry run takes me to this path for the drop of the first tx. Please correct me where I am wrong.
PS: I might do a test tx to see it myself. This is interesting for me.