I think the best analysis would be to start by taking the longest period possible. If the odds of performance that low by luck alone over that longest possible interval is not less than 5%, I'd say you can pretty much ignore the possibility of cheating on the part of either miners or the pool. If the pool is stealing from miners, it's not like sometimes they're going to cheat and sometimes they're going to sneak in bonuses.