Actually, what's most alarming about this is that the programmer that discovered this appears to be simply a solid developer (not a genius).  His thinking and experiments are logical and repeatable (by others without knowing). 

Is it possible to create a similar "capture" program that simply captures and returns the btc back to the sender, along with some sort of message that can be used to flag the transaction? This way, over time, it will be easier to determine the source of the code.