As I said here, refunds don't have to be completed all at once, but gradually by processing legitimate claims (users who signed their addresses) first. It only takes one verification per address, then you can ask the address owner to list the txids of the output tx that end up in your hot wallet.

For users sending funds from a centralized wallet, I prefer the video capture proof from the phone showing a detailed history per their wallet withdrawal to your exchange deposit address.