One: It seems likely the botnet is mining again.  There are Monero (XMR) botnets out there and since this coin is CPU only, it's fair to believe botnets will target it too since a malicious botnet operator has nothing to lose by using up your CPU even when coin prices are low.

Two:  You haven't looked to see what the hashrates of those new miners are.  I personally pulled a couple beefy machines off and went solo with them (I still run pool on most) and I know two people that just started on low powered laptops.  My hashrate per machine was about 10x what they are getting since their machines are weak.  Given the amount of attention we're getting with the Masternodes, it's not that hard to imagine that a lot of casual users have come on board, while the high powered users have gone solo to avoid the pool fees.

Three:  The reason for the high pool fees has been explained repeatedly.  There was a security breach and a theft of the pool.  The pool is not run out of the funds of the coin, it is run on the back of the Dev, so even if he made security mistakes that led to the problem, he should not bear the cost of the fix.  Again, the pool is NOT the coin.  In fact, if enough outside pools pop up, I'd highly recommend the Dev stop running the pool, but until that happens he's doing what is best for the coin.