Let's look at this from a different vector.

I don't use cgminer, but these miners come with a certain amount of remote management right?

Can affected users confirm these ports are exposed to the internet? Possibly you use it yourself to monitor your miner while away from the house?

Wouldn't it be more plausible an exploit was found in the miner's API that allows an attacker to issue such commands?
Try changing your API password to something much stronger?