As confirmed above, it was GPUMAX (or pirate40, to be precise - even tho I have no real proof for that) that was pool-hopping us, using his own account (registered with a fake e-mail of course).
Do you happen to still have some record of the payout address used?