rhetorical question: how fast can you plan and implement such an complex attack if you are not aware of such a "reload" feature upfront?
The integration of Moonpay was already leaked in mid November 2019, when a spanish Trinity tester (accidentially ?) tweeted about it and deleted the tweet shortly after.

IOTA
officially announced the integration of Moonpay on December 18th 2019 then.
The IF tracked the attack back starting at November 27th 2019:
This, together with the security analysis, painted a very clear picture of the stages of an evolving attack that dates back to November 27th, 2019.
See:
https://blog.iota.org/trinity-attack-incident-part-1-summary-and-next-steps-8c7ccc4d81e8
EDIT: is the user account of Dominik Schiener not known? he has a Bitcoin history (Switzerland based Crypto exchange which did broke) and I assume he was active here on bitcointalk.org too.
This is his account. He officially only joined the IOTA team in early 2016, since he was still busy with some other ventures and he even missed the ICO and had to buy his stack OTC, what you can also track a bit by checking his posting history in bitcointalk.
A well respected german user, who followed IOTA right from the start, talked about that
here and
here.