Okay, this one sounds a bit murky to me, too, but it grabbed my attention because our own online banking includes exactly this kind of bill-pay procedure, which can even be used to send checks to private individuals (such as to pay a babysitter or send a birthday present to a grandchild).
Sounds to me like it's the paying bank that was in the best position to prevent the fraud, in that it was their own online security that was breached to create these items. If they'd caught it by midnight, fine, but now, I would think they'd have to decide whether to pay their customer or try to argue that the customer was in some way negligent (for example, by sharing a password with someone who then used it to make the drafts).
That's my best guess at this time, but I'd love to hear others weigh in.
_________________________
Opinions expressed do not necessarily reflect those of my employer or of my cats.