Already a new interesting development since posting this thread. I received a password reset link to my email. I have 2 factor auth on gmail and nobody signed into my account, yet the link was used to sign into my BTC-Casino.io account.

I open the site and see this in a live chat already open:
http://i.imgur.com/zTvmx0k.png

From the withdraw screen I see 3 new requests:
http://i.imgur.com/i9icGZG.png

These are obviously not mine, and I fully expect BTC-Casino to pay this "withdrawal" to whatever address is on that, and then blame me for being "hacked" when I say I never got it. I think this is pretty cut and dry what's happening now.