Good find, ikeboy. You have uncovered 1 transaction going to a real person , coming from the mixing groups. Well done. How does that change that the other 99.999% of transactions go to either exchanges or accumulator wallets? When you are done tracing all of those, then you can work on an explaination of how these mixing transactions kept occurring the whole time Paybase was locked up and people could not do transactions.
You said that zero transactions went to customers, I disproved that. Many addresses have been in use for months, but don't show up in google searches other than blockchain results. Those probably belong to individuals who didn't post it online. It's not possible to prove one way or another who such an address belongs to, and note that what I said above was that it's possible for it to be matching withdrawals, not that it was definite. They could be skimming off also.
And as for paybase being down, which I didn't test at the time, there could have been a backlog that was approved while it was down. Was it down during the entire range of transactions?