The two threads I have been following on this incident continue to be fascinating, but have shown no evidence of being related to ghash.io, despite my initial inflammatory post here.
ghash.io warrants some suspicion for various reasons, but make sure there is proof before breaking out the torches and pitchforks.
grnbrg.
Indeed, there is no proof.
Except, whoever is doing it has a lot of hashrate, probably more than they want to admit. And it seems like the only major pool profiting from this is Ghash.io.
I've seen the pitchforks broken out for less...
Also, keep in mind it's a good idea to avoid Ghash.io regardless of the block withholding attacks, seeing as 51% and such.
EDIT: Actually, strike that. I was wrong on both counts: it probably wasn't Ghash.io, and they certainly didn't profit from it. But still, 51% and such.