It's possible than when the site does come back online, the attackers could quickly log in as some of us, change our bitcoin address to be theirs, lower our payment thresholds and steal our confirmed coins...
Or am I being paranoid...
Your being paranoid. Slush has the account passwords protected. And even if they do manage to gain access to some accounts, Slush will see the unusual activity immediately and put a stop to it. Like I said earlier, he likely won't enable payouts right away. He will wait to make sure everything is on track.
He is very security conscious, and always does his due diligence. That's why he has so many lifers mining for him...