Here is what I think may be happening after thinking about it for a little while. BTCGuild and some other pools, such as Deepbit, or Slush or Ars Bitcoin are actually run by the same people.

The operator of BTCGuild is intentionally manipulating the luck in the pool making it drop very low and then jump up to unexpected highs. On low luck days, they would be doing this by having the pool capture some of the winning shares and sending them over to one of the other pools where that share would be sent out to one of the miners to win. On high luck days, some of the winning shares on the other pools would be captured and sent over to BTCGuild and sent out to the miners to have them win.

During this time, some of the winning shares may be sent off to a private pool where some of the loot is kept, or are sent off to a PPS pool like Ars Bitcoin and help build up that big 800 BTC buffer that they have. Then somebody gets to keep that buffer.

But the amount of actual stealing that takes place depends on weather or not people notice. By manipulating the pool and adding positive luck, it really a great way to make most people not notice that something is wrong. So right now there is probably very little stealing actually going on but there is still a high degree of manipulation!