How did Professor Slughorn not notice a year's worth of polyjuice potion going missing?

Question

A key reveal in Half-Blood Prince is that, despite the school's increased security measures, someone has been stealing polyjuice potion from Professor Slughorn. The context suggests that the amount stolen was enough to last two people long enough to cover a year's worth of on and off use. Do we know anything about how he both failed to notice and prevent this happening?

Answer 1

It's never expressly stated, but there are a few theoretical reasons for what happened

1: My personal favorite is that Draco used the refilling charm after scooping out however much he stole. It's the same spell Harry uses in Hagrid's hut when he's getting Slughorn good and drunk after Aragog's funeral. Then you'd have a cauldron of presumably perfect polyjuice potion (or at least looking perfect, and we have no indication Slughorn would have tested it) so there's no investigation at all.

2: Second choice would be something on the order of Gemino (the duplication spell) to visually duplicate the potion Draco stole. He takes the real stuff and puts the duplicate back. Again, no investigation. Though if the potion is stored rather than disposed of there is a chance the spell wears off and the missing contents noticed.

3: Slughorn noticed, but failed to act. Slughorn goes to clean his cauldron/store his polyjuice potion away, and realizes some is missing. But he fails to report it to Dumbledore because he knows only a kid could have taken it, and doesn't want the fallout of the theft to come down on him. After all, none of the kids in his NEWT potions class are Death Eaters! So he goes about his business and hopes it won't get noticed, or if it does won't get traced back to him. This seems in keeping with his character but seems a bit less likely than the first two.

4: Draco didn't steal any Polyjuice from Slughorn at all. He just got the idea from the class. We know from Harry Potter and the Chamber of Secrets that Polyjuice is tricky and requires special ingredients, but also it's not tricky to the point a 2nd year with brains couldn't do it, and the ingredients are available at Hogwarts. Draco is a 6th year in NEWT potions and Defense Against the Dark Arts, and likely could get access to Most Potent Poisons (the book with the polyjuice recipe in it) without undue trouble. Same for the ingredients. He may also have gotten the potion delivered to him from the outside (We know from Harry Potter and the Goblet of Fire that sneaking in non-dark items via the mail isn't hard, and polyjuice isn't dark magic). Though I think the outside delivery theory is unlikely when you consider how secretive Draco is about his plans with anyone who lacks direct Need to Know.

5: As mentioned in the comments, Slughorn could either have not noticed, or reported it to Dumbledore who decides to take no action under the assumption Malfoy took it. Of the two I think the former is more likely, but less so than 1-4. Slughorn after all isn't an idiot! But it only takes a little hurry and/or inattention for him to magic away the contents of the cauldron without noticing some was gone. If, imo, Dumbledore had known Draco took polyjuice potion he would done something to let Snape know, since Snape is the one "keeping an eye" on Draco. He can't do that if Draco can be someone else!

Answer 2

There is a lot, and they only need comparatively little - it made no visible difference when they stole it during the lesson

Don't get thrown off by the movie, in which the cauldrons are tiny things which all stand on Slughorn's desk:

(Also ignore the fact that he claims to have prepared them "this morning" when it has been well established that taking the Polyjuice Potion takes a lot of time)

In the books, with the exception of Felix Felicis, all cauldrons stand on the floor of the dungeon, and not on the desk. And apparently, they have been huge!

While Harry describes his epiphany to Ron, he confirms that it was a) a lot (a vat, which is a barrel, which, depending on the size, can hold more than 150 liters of liquid), and b) there was plenty of opportunity during the lesson to steal some of the potion.

"God, I've been stupid," he said quietly. "It's obvious, isn't it? There was a great vat of it down in the dungeon... he could've nicked some any time during that lesson..."
"Nicked what?" said Ron.
"Polyjuice Potion."

(Harry Potter and the Half-Blood Prince: The Unknowable Room)

So how much did they need anyway?

Harry Potter and the Chamber of Secrets tells us how much potion Harry needed for the duration of their aventure:

Pinching his nose, Harry drank the Potion down in two large gulps.

(Harry Potter and the Chamber of Secrets: The Polyjuice Potion)

Now, I'm no gulp expert, so I won't fight you on this, but I would think that "a large gulp" would be around 50ml. This means that one person needs around 100ml for the potion to work for one hour (which was the time limit in "Chamber of Secrets")

Additionally, for all that we know, Crabbe and Goyle never took the potion together: On both occasions, Harry, Ron and Hermione only run into one girl being on guard: One carrying frog spawn, the other with scales. So all they needed to steal was enough supply for one student throughout the year.

Barrels can hold a lot of liquid, and the potion was still boiling during the lesson, making it harder to see the difference if something is taken from the barrel:

Harry, too, recognized the slow-bubbling, mudlike substance in the second cauldron.

(Harry Potter and the Half-Blood Prince: The Half-Blood Prince)

Now, the total amount of times they have been in the room of requirement with someone on the outside on guard is unknown as far as I know. But it's safe to say that stealing, say, 10 liters would not made an obvious difference if you hadn't paid attention, and it would be good for 100 uses - which means 100 hours of Crabbe or Goyle in disguise.