Short answer: Yes, they're breaking the law.
A "contract" in Ethereum is not the same thing as a legal contract; Some people have suggested that the term is quite misleading, and it would be more accurately described something like "agent". So generally the contract source code doesn't legally define what would be a legal or illegal way to use it.
With the DAO hack, there was actually a Terms of Service document written by the people who had created the contract to the effect that the behaviour of the code was the definitive guide to how you were allowed to use it. Taken literally, there was an argument that this made the hack legal, since the code allowed it to happen. However, courts will generally apply common sense when dealing with obviously broken contracts and terms of service, and the common-sense interpretation of what happened is that it was theft.
initMultiowned case there were no legal documents contradicting the common-sense explanation of what happened, so there is very little ambiguity about the fact that normal laws would apply. Specifically what laws would be applicable will depend on jurisdiction, but most jurisdictions have laws allowing them to prosecute people who they catch taking something that doesn't belong to them by exploiting a bug in a computer system.