+1 for vector76's hypothesis from me as well.

This seems a lot more likely than my double block mining hypothesis.  This would also be harder to protect against.

Anyone have ideas about how to stop this sort of attack?