Who is the subject complement of is. Subject complements are either adjectives (predicate adjective) or nouns (predicate nominative). Thus, it requires the subjective (nominative) case for the pronoun.
To elaborate: Subjects are nouns, pronouns, or things acting as nouns (don't worry about this last one) that are the actor of a sentence (this is a very simplified analysis as there is more nuance than that). Nouns don't usually have case (except the possessive/genitive [John's]); pronouns do however inflect (change for case). The cases of pronouns in English are: subjective (nominative), objective, possessive, and reflexive/intensive.
Illustrated:
He is subjective
Him is objective
His is possessive
Predicates are verbs doing the action in the (main clause of a) sentence or linking subjects with other elements (again, this is simplified, and not a complete treatment). The type of verb you used (is) is a linking verb—it joins subjects with subject complements).
Illustrated:
John rode a motorcycle.
Frank is dumb.
Subject complements are either nouns or adjectives connected to the subject by a linking verb, such as is. In the last example, dumb is a predicate adjective because it is linked to the subject by is. An example with a subject complement that is a noun is:
John is a master.
She is Jill.
This is he.
The last example is not common in speech (fallen out of its very restricted use [answering phone calls]) and is normally replaced with him.
Now onto who/whom, who is subjective, and whom is objective. Any easy way to picture it is who represents he/they/she/it/I/you/we and whom represents him/them/her/it/me/you/us.
Your example stripped from the sentence and made into its own sentence with the exception of the place who substitutes:
The thief is X.
In everyday speech, people will say him, but grammatically, because the subject has a linking verb which takes a subject complement, it is he, or for your example (Bob does not know who/whom the thief is) who.