I think the most probable answer is that whoever controls Zencloud is dumping stake. There's a big difference between the stake rate of hashstakers and the stake rate of a prime controller. Those transfers out could easily be stake going to a set of wallets, then either being withdrawn by hashstaker owners or dumped on an exchange. It's a mix, which is why it looks like a jumble.
That's also why the numbers wouldn't add up. Only some of the transfers are to ordinary users. Whoever controls the Zencloud wallet ('mk', I guess, though I haven't checked the sig) could easily be both dumping and filling user accounts. There's enough stake for both.
I said this on the hangout. They need to close Zencloud. It serves absolutely no purpose except whoever is receiving the $37,000 a month it costs to run it.(That was the cost told to me on the hangout) Before or after it is closed we need to see all the in and out addresses of bitcoin so we can total up how much has been stolen. It should be very easy for @Paul Revere to figure out how much Garza has by those addresses.
No one is receiving $37K a month to run it. Just like mississippi isn't getting their $350K. This is the payment address which was posted elsewhere for the monthly contract fee: BTC: 19krd1w3S66r3abj8ZgLWC5NsK5LSVPPvr