According to the settlement letter, third parties used the firm’s cash management brokerage account to withdraw funds from accounts they’d illegally accessed at other financial institutions.