A solicitor whose firm received over £530,000 into its client account from an unknown third party, “sat on it” because “we just didn’t know” what to do, a tribunal has heard.