maybe there is someone who owned a gpu miner but hide it for the community....
or
some botnets are online...
some math
we got 20mh per infected pc...a botnet own easy 2k infected pcs..

so it could be both

https://chainz.cryptoid.info/neva/address.dws?NYYvBhcdcEtyMwNe1nKec6Ln5wpr471xSA.htm

this is the link to the addy from the guy who mined on the p2pool with a huge hash i guess