I think we can tell the difference by looking at the claiming transactions.  However, Alitin has a real problem here going forward.  They will need to try to differentiate between the people that got ripped off by having their BTC swept by the thief and the people trying to rip them off by reclaiming the BTC themselves and then filing a claim.