In retrospect, the biggest red flag should have been when they went from being very active to almost completely inactive on Bitcointalk. It looks like they lost interest because the site didn't gain the traction they hoped for.
When people should have been suspecting Whirlwind to be scam is when they begin anonymity mining or something with 12% APR. I do not know much about it but it is like a way people will leave their bitcoin on on the centralized mixing service. Many people will be affected.
Another way that people can think of is when they begin paykng using note public key to the Whirlwind participants on this forum. Funds are paid from note public key into note public key. It would have been better if it is paid to individual bitcoin addresses on their self hosted wallet.