I agree that most 1aa.. addresses probably belong to amaclin (he has been using vanity addresses like this since December last year). However I doubt that 5. is a correct conclusion unless you can show me a transaction where one of the 1aa addresses is used as input for the original high-fee dust creating spam transactions.
That he "started early" could easily be explained if these addresses were weak brainwallets (coinwallet.eu used brainwallets in their first stress test). Also amaclin has the programs and the knowledge how to sweep these addresses. This is why he got a big part of the "Bitcoin Giveaway". There is nothing wrong with that, of course.
BTW, are there 791 published private keys now or have I been missing a post? I count about 6.5 BTC left in 650k coins (all are probably already triple- or quadruple-spent but still unconfirmed).