tl;dr - There are are 3 likely suspects...
KNC, ghash or BTCGuild
I doubt it's Discus Fish since many of the people who would leave Eligius for calmer waters would not pick a Chinese centric pool
If it is not the above three, then it is something personal and/or jealously as the driving factor
KNC does not make sense to me - disrupting other pools does not improve their own since it is private. And there are more chinese miners than you think - its entirely likely some eligius users would be able to speak or translate it (but I agree it *may* not be enough to warrant the attack by discus fish)
perhaps, but there are probably more than a few hosted miners in KNC that point to Eligius.. those would be in play
my gut feels something is bigger going on than just DDoS attacks. I keep thinking the HFT jockeys have analyzed pool mining nuts and bolts and are figuring out some minute disrupting tactics that provide advantages
if I ran a pool I could look at some things but as an outsider I can only speculate. we all have heard of the selfish mining tactics and that may be going on but what if there is a way to mess with the work distribution in a way that you are boxing out large areas of the nonce for yourself through disruption
people say, well the nonce is unique since it is attached to your address... well Eliguis posts everyone's address so couldn't that be taken and messed with by some script jockey if they knew what they were doing?
all I am saying is think about something that isn't known yet as attacks since there are attacks ongoing and the 'luck' in Eligius and BTCGuild is more than just luck