xploited - based on the above i assume this person has made themselves known?
Not to my knowledge; though some people have some theories of possible entities.
The 3%~ figure comes from assuming:
A. The distribution was shuffled before sending; i.e. it is randomly distributed over distribution blocks.
B. Claims are proceeding in an ordered block-by-block fashion.
C. The percentage claimed from previous blocks.
D. The assumption that blocks "ahead" have not been previously claimed by the user.
E. The assumption that blocks "ahead" will be claimed eventually.
F. The assumption that, given the random distribution, blocks "ahead" will contain proportional claims.
So, a few assumptions are being applied to come up with the estimates

Good to know, in my opinion the digging of clam is to allow many people to benefit, not just 1 person or entity.
In a case like this you have to assume either the following;
- Person/entity found a bug and exploiting
- Actually have all those valid addresses, which i find still unlikely
- Malicious, they stole those addresses
Based on the above,
- Have there been a 'control' check to see if there is a potential bug/exploit
- if we are saying many people should benefit from the dig, surely there should be a limit on clam clients on how many addresses they can dig, daily or over the lifetime
m2c