I've checked the logs. It appears that the amounts stolen were (in size order):
0.00018560, 0.00069031, 0.00930999, 0.00990000, 0.01006117, 0.01137880, 0.01773303, 0.02915000, 0.04515912, 0.04542498, 0.04976687, 0.08471695, 0.60705816, 0.88197790, 3.87314367, 60.07364941
If anyone would like to donate to make the victims whole, I set up address 1GbDrpVNGxC8CxfZrYMPVPZ2KNwvcXEHT7 for donations. Anything sent there will go to the 16 who lost funds.
Thanks for all the donations. A total of 2.40995525 BTC was received so far (not including the guy who paid one of the victims back in full privately). That's enough to pay all but the biggest three back in full. If I give the biggest 3 the same as the 4th, then it totals 2.696 BTC. I'll make up the difference:
0.00018560 0.00069031 0.00930999 0.00990000 0.01006117 0.01137880 0.01773303 0.02915000 [0.04515912] 0.04542498 0.04976687 0.08471695 0.60705816 0.60705816 0.60705816 0.60705816
I will refund the victims as soon as they reclaim their accounts and enable 2FA. I don't want the attacker withdrawing the refunds too!