What about the user database? Was it compromised? I'd hate to see bitcoins sent to the wrong address.
I have a database snapshot taken before bad guys overtook the database. So there's no reason to think payout addresses have been modified. Any change of wallet on pool profile requires email confirmation by account owner so I think we're on safe side here.
Unfortunately the user database can be considered as compromised, so the attacker knows user's emails :-(.