The part you're missing is that GAW's coins and 99% of their customers coins are all intermingled in the Prime Controller addresses. (If GAW's numbers are to be believed, they are holding ~3 million customer coins.)
There's a good chance that GAW owns more coins in non-prime controller addresses than customers do. It wouldn't surprise me if Josh owns 1000+ addresses with medium/small balances. After all, they do put tons of effort in to obfuscating the blockchain.
Wrong.
There's a good chance that a former employee of GAW is just pulling the wool over everyone's eyes? Why not eliminate every prime controller? Sounds like a plan? Let's get working on that!