I would suspect that it was someone who was sitting nearby and knew that it was the bag of someone sleeping. It would seem rather risky for someone further away to open a random bin and rifle through a random bag not knowing who it belongs too.

Not that it helps much. One reason I generally don’t put my wallet/passport in the overhead bin carryon (with limited seat storage I usually wear cargo pants aboard).