Dont worry ethpool is not hacked. Propably those big adresses are some mining services' or big mining farms. Some of them are claymore's devfee adresses. If you have a lot of money you can rent a lot of hashing power.
I have quite a few reasons to be worried. First of all, if those are mining farms, or cloud providers, they would not change wallet addresses so often, and they would have stable hash rate. And about Claymore's devfee, even if all network uses Claymores miner, on net hash of about 71 TH/s and 1% fee, it would be around 700 GH/s. And why this is occurring in just last few days, not before? And why all of them looks the same, with huge variance in hash rate over the time, and with wallet address as worker name? So, i would say that your conclusion is not quite right.
Probably just someone buying a bunch of hashpower from nicehash or maybe a bunch of people got hacked and someone is funneling their hashpower.