Here's some proof that this was customers, at least partially. I followed the transaction Paul linked until it led to https://chainz.cryptoid.info/xpy/tx.dws?474805.htm. That sends 3.21 XPY to PMinemanWoBbpPhxeoV7Zy8kND6nMZJMSR.htm. That struck me as a vanity address, so I googled it, and came across https://webcache.googleusercontent.com/search?q=cache:10aSkaqC_JIJ:https://hashtalk.org/topic/31206/wallet-minting%3Fpage%3D1+&cd=4&hl=en&ct=clnk&gl=us. (https://archive.today/0FT9O in case it goes expires).

So this address was in someone's sig over a month ago. Does that qualify as an "average Joe" who got a withdrawal, or did I somehow make them up or something?

Also, they said they were manually confirming transactions. These could have been from the backlog.

But go on denying the evidence, it's cute.