I'd suggest that wherever the cash arrives to, you leave it there, untouched and building up each month. Later, you could claim that you 'didn't notice,' but if you withdraw it and put it somewhere else every month, then you obviously did notice and deliberately kept funds you weren't entitled to. Your policy of ' I'll give it all back if and when they notice' still leaves you vulnerable to accusations of deliberate concealment, so I repeat, a) don't touch it or anything once it arrives with you and b) check your Reddit history to make sure you're not identifiable. Also if you have any proof of your initial telling them what they'd done, that you can show if the excrement hits the ventilator, then it makes it more deniable that after it happened the first time, you ever noticed again. I mean, what a shock you will get if you see they kept repeating the mistake after the first time, and you notified them. All those months and you never noticed!

Being practical, this is double edged. You spend the money, and some time in the future, at their yearly audit or whatever causes them to wake up, you've dug yourself a grave. Leave it untouched, and frankly, what's the point? It would only be usable if you went abroad or disappeared, or the company went bankrupt and the insolvency people never noticed. Is it worth that, just for a bit of fun that could rebound on you?