Thanks for sharing. I thought ghash.io was the only time the pool went above 50%. I got into Bitcoin in late 2013 ao wasn't around when the first two times happened.
I guess we can draw the conclusion that the simplest and cheapest way to perform the attack is not to buy or produce enough hashpower, but to create a pool (or few pools pretending to be independent) and attract enough miners.
The 51% attacker can then mine an alternate chain to replace the last 20 blocks and include in that chain a transaction which sends the same 100 BTC back to one of their own addresses.
But that new chain would get rejected by the majority of the network, meaning nodes, right?