TradeFortress has been logging into various online accounts since the 23rd/10 right before the hack. Some of these haven't been used in years so I'm assuming it was an attempt to delete identifying information, too little too late...

https://www.ozbargain.com.au/user/78285
https://forums.digitalpoint.com/members/gladoscc.665485/

This one was logged in yesterday, and he's been away from bitcoin world since the 21st, so he's out there, watching...

http://askubuntu.com/users/29487/gladoscc