I recall seeing some mention in this forum that MyBitcoin doesn't follow the usual coin-selection and change-making rules, presumably because its Bitcoin-handling code was custom-written; and that it shuffles coins around between its own addresses. Given this list of addresses, it should be possible to learn some things about it; and I strongly suspect that its transactions are distinctive in some way, which should make it possible to find *all* the MyBitcoin addresses.

Another theory - the reason MyBitcoin came back briefly and returned some coins, was to get plausible deniability when spending the coins that were stolen.