The way the mixer works is this:
1) You put the coins you want mixed into the system.
2) After just a few confirmations and subtracting out the 0.5% fee the mixing system sends you new mixed coins that
it already has in reserve.
3) At that point the thief was done, they had their stolen coins back from the mixer
within a few confirmations.
4) After the transaction is complete the mixing service goes to work on the coins that the customer sent to them. The coins are chewed up over many hours/days and spun with other coins they have in reserve getting them ready to send out to
other customers.
So, you can see that the addresses you are looking at have nothing to do with the thief's new coins they got from the mixing service.
Your statement:
Wrong. No mixing has taken place on the major balances
is incorrect. It would more acurate to say. The original coins are being processed. The thief is long gone.
But then there is no point of thief returning the coins, only if he knows that he exposed his real IP, or left any other traces somewhere along the way.