I don't think AV software is necessarily very helpful in this case, since the miner is likely installed with the user's permission, either bundled with another program that they just click through too fast (a la utorrent), or installed surreptitiously when another program is installed. This has been a topic of discussion lately in the vertcoin thread, as one pool (ipominer) has apparently had a big botnet mining at it's pool that is a substantial part/majority of the network ( https://bitcointalk.org/index.php?topic=895020.1100 ). The pool in question tries to deny that it's actually a bot net, arguing semantics, since apparently people are installing it just by clicking through the installation options too fast when installing some other program.

Anyway, I think there's a few other options that kind of fall somewhere in between option (1) and option (3). Like, if someone works with/owns a large server farm, and their only running it at full blast in off hours, or maybe even a gaming focused internet cafe or something, where they have a bunch of comps equipped with gpus that they can run in off hours. Who knows...

With that being said, I pledge about 3.50 XMR to the bounty proposed in this thread