The part you're missing is that GAW's coins and 99% of their customers coins are all intermingled in the Prime Controller addresses. (If GAW's numbers are to be believed, they are holding ~3 million customer coins.)

There's a good chance that GAW owns more coins in non-prime controller addresses than customers do. It wouldn't surprise me if Josh owns 1000+ addresses with medium/small balances. After all, they do put tons of effort in to obfuscating the blockchain.