It seems OP already received a reply from btc-e, and the site literally replied "can't refund and return your money". (refer to post #15)
OK.. missed that part. But how was the transaction confirmed by email? Was the email hacked too?
So from this we've found that the ip 62.4.8.72 is the malicious one. And they are located somewhere in France near Paris. I'm going to contact the owner of the IP range and do some digging.
I am not sure whether it is one of the TOR exit nodes. Or might be a proxy.
This one says that it is a Dedibox (?) connection.