How did you pick up the vulnerable transactions?  Those weren't relayed through the bitcoin network, just published through their API.  With signatures which were mutable into standard format.  (Which we can assume the attacker did for his own transactions.)