If it's only 2 shares in 13 hours then its nothing..
Looks like a looooot of people using this software if it can build up a constant hashrate - even 20mhs

Well, it is not 2 shares but 2 works in 13 hours. For a 100MHs mining rig that would be aprox. 30 shares. That is quiet a number.
I can confirm the share-theft: it happened twice this night, that NoDevFee mined to the 0x78.. address.
PLUS I caught a mining attempt to a private stratum-server with IP 147.135.221.69 and worker-names terraman.3 and terraman.4

Actually, it would have been no problem, if the extra-mining would have been communicated. But this way, it leaves a stale taste..
I will disassemble this code now to see, what is going on.