Here is a highly likely possibility... The GM's took all your gold away and gave it back to the scammie and you AND your friend got banned for 3 hours... but... they didnt check your friends mailbox and it sent it back.
They only take what they record people have gotten.
I got banned for using that fly hack awhile back to kill bosses in KARA, TK, and SSC with 5 other people. About 5 hours into it, I got banned when we were soloing Tidewalker 40%. They took away a "FEW" of my items and my few void crystals I had in my bank... cause I DE'd some of the crap. But this is where it gets weird. I gave all the void crystals to a friend in trade. They took the ones I got 'by the book' in my bank and took all but 2 things from me... My friend got all his/traded void crystals away BUT he got to keep all his gear.
Could it be they didnt check the logs BUT took [what could of been] DE'd and left us some of the loot by mistake/overlooking?
And btw, I was on another account while I was banned for 3days, my hunter friend logged on... but he was BANNED for 2 more days. They actually Log on your characters and search through your bags & bank and delete what you got.
Free TK/ SSC boss loot ftw
Point being, these are human searches, and if you have the right things you can keep your stuff if you plant the right things.
And chain mailing money should work if you kept your gold from just 1 mail. Even if they check all the logs of the mail, if you send it to 20 characters on 2 accounts or a few friends. But you could get banned or all of them banned, but mass banning of 10-20 people may be extensive by blizzard so you might get away with it.