Here's how stuff worked on this exchange. Every user got a deposit address. Once a deposit cleared, a script transferred it automatically to their hot wallet which was used to fund withdrawals. Looks like they didn't have cold storage and didn't even have private key backups of that hot wallet (WTF really?).
Do you mean they use disposable deposit addresses? I'm just reassuring that they won't store every new deposit address of every user (especially if it applies to all coins) because that's a huge database unless it ends up burning. That's why they will deny ownership signed message verification because it's definitely useless. They failed at this.
no, you misunderstood. Each user was assigned one permanent address for deposits, and then all the coins from these user addresses were sent to a common wallet, where they were all stored. Therefore, it is not difficult to find out who made deposits and the total amount of each of the coins, but Altilli decided to blame all the losses from the hack on users or this is another exit scam.