The bulk of the remaining offline wallet funds are funds held and currently untouchable in the offline wallets from the withholding attack over a year ago which is awaiting legal confirmation before I can distribute it to affected miners from that time period.
What can I do if a wallet from that time got compromised?
Nothing can be done on Eligius's side, since moving funds from one address to another is not possible.
Edit: I suppose you could sign options that donate 100% of the address's earnings, so at least whoever compromised your wallet wouldn't get the funds.
Then why couldn't he do that to move it to another address?
Because not even I can move funds between addresses in the reward system. Not without removing all sanity checks and rewriting half of the code to get around the basic security premises behind the share log. The only thing in place to even remotely do so are the donation functions, which require a signed message to work. I can't set anyone's donation amounts for them, either, since I can't sign with their address.
I suppose a 100% donation settings, then afterwards a signed message to me with a new address to manually send the funds (along with a brief summary in the signed message so I can keep it for records) would work in this case, since the funds would be rewarded all at once at a known time. This wouldn't work under normal circumstances, however, since donations only happen when shares are rewarded in the reward system and not when a payout is actually made. Most people contact me after they already have a balance on an address they want to move funds from, which is literally impossible..... not to mention most of these people contacting me are just trying to scam anyway.