How can you be certain that the hash theft attack was in progress for at least 14 days or so? (And presumably what you are implicitly suggesting is that it was only noticed over the weekend as it might have scaled up to a much higher level?)
I have a rig... Other rigs were mining rock solid all the time. But this rig had constant load drops - for a 30 seconds, then back up.
Then the other rig started to act the same way. At that other rig I found strange connects.
I implemented filters ASAP.
Both rigs (with all other rigs) are mining 100% null problems since then.
And what specifically do you mean by 'strange connects'? -- as it could be very relevant. Do you keep miner logs by any chance?