- His Electrum isn't a genuine version of Electrum (only valid download site is https://www.electrum.org/#download, additionally you should NEVER skip to verify the authenticity of your Electrum download by checking the GPG signature
- His computer where Electrum runs is infected by some sophisticated malware that was able to manipulate even a genuine version of Electrum (OP doesn't use a hardware wallet as signing device)
- If OP sent coins to an address of his Electrum wallet and those coins (and likely the rest of his wallet) got immediately transfered to another address which is not under control of OP's wallet then obviously OP's wallet is compromised and someone else knows his wallet's private keys and worst his wallet's mnemonic recovery words
- OP may have entered his wallet's mnemonic recovery words on some online website (being tricked to do so or simply by not knowing that this is an absolute no-go)
- OP may have stored his mnemonic recovery words on an unsafe or compromised online digital device
- OP may have taken a digital picture of his mnemonic recovery words and this picture got duplicated to whoknowswhich cloud storage (you have no control whatsoever what such cloud storage may do with your pictures; assume no privacy at all especially when cloud storage is for "free", lol)
- OP's physical backup of his mnemonic recovery words got somehow compromised
- OP has chosen his mnemonic recovery words by some crazy and unsafe and not random at all procedure
- OP got forged mnemonic recovery words by some malicious actor without knowing that this is an absolute no-go
I might not have exhausted every possibility but maybe the most likely ones