Well, what I do know.

IPs during the incident, after the loan, were different (Tor).
moreia_alt's IPs do match moreia's.
Whoever is logged into moreia's account currently is also using Tor (odd).

I'll leave the speculating for others.