I didn't look into this situation in much depth at all but had noticed the mixing service itself making a statement (which I thought referred to a lot more than just some tags).

So the hacker has only mixed a small % of the coins?

The 36 days still seems rather fishy to me though.