4) Maybe all these 40k coins have been just bought by some customer on GOX and transferred to his own wallet. But then we should be able to identify some "cold wallet" in between of the the corresponding transactions, should'nt we?
I think this is a good point.
The 424k certainly were sent to some cold wallets after he provided proof. While not likely, it is certainly possible someone bought that many BTC from Gox in one go, but then, as you said, we should see some in between cold storage.