Assumptions make poor foundations upon which to build any theory. Though hard coding ip addresses will circumvent the problem for now, it may cause unexpected outages in the future if pw reconfigures the server network.
Sorry, I take back the word assumption if you're going to be semantic.
Here's what I've seen, which I'm using to create my "theory": I have 2 mining setups, both pointing to useast.wafflepool.com. The two systems use different miners, one is using cgminer running under BAMT, the other is using cudaminer under win7. Both systems are NAT'd behind a router running dd-wrt.
With the difference in miners / systems, I don't think someone trojaning both my systems with different miners / OS's / authentications at the same time is likely. With other people reporting the same issue, it makes a lot of sense that some sort of DNS hijack took place.
I agree with you and don't recommend people hardcode an IP in their miner configs for long term use, but for the immediate future it would negate any sort of DNS issues should they continue.