last night's DDoS attack
By any chance, could there be some relation with the test servers you had recently set up ? Could their IPs have been nearby the IPs of the main servers, therefore giving some direction for location to the vandals ?
The test servers would still be behind Eligius's normal DDoS protection, just on alternate ports. I also hadn't provided info on them to anyone yet.
Is there a recently joined worker or set of workers which stopped mining just at about the time the saturation attempt began ?