The 12% APR was quite high and maybe should have raised concerns. I suppose it is the same with the Notes payout. Unfortunately, hindsight comes to mind.
When people should have been suspecting Whirlwind to be scam is when they begin anonymity mining or something with 12% APR. I do not know much about it but it is like a way people will leave their bitcoin on on the centralized mixing service. Many people will be affected.
Another way that people can think of is when they begin paykng using note public key to the Whirlwind participants on this forum. Funds are paid from note public key into note public key. It would have been better if it is paid to individual bitcoin addresses on their self hosted wallet.