The second quote makes it sound as if the "reveal old seed" behaviour could be made to happen without the "replace old seed by new seed" action having been done first. Maybe sending too many requests at once could trigger that. But it doesn't fit in with the first quote.
I had thought that was the trigger, and could affect the other sites as well. As for the final address it wouldn't help as it is likely he wouldn't have sold the coins and in the past it has been unlikely that any hacked coins have been recovered.