I am not sure someone could mix that easily a big amount like that.
Probably he would need smaller chunks.
The refunded coins you have recieved certainly seem to be from a mixer, so I think it's fair to assume they were mixed by the hacker.
bitmixer say on their website they can handle sums of BTC greater than 1000BTC if they have at least 5 confirmations, so it doesn't seem impossible the hacker sent it through as one 1170BTC transaction.
That said, the scripted mixing of the 221BTC started here (as you will see, the timestamp ends with 02 seconds. The mixer processed all splits after that at 02 or 03 seconds into a new minute, obviously indicates a script at work):
https://blockchain.info/address/17eHmNKr6Cb1U4uBhcnfs3iwWKsZGtRLaVMixing 410BTC started here
https://blockchain.info/address/16j6RQrJc3cyGEqe6BtApXkoNZ4Yy5z5WoMixing 540BTC started here
https://blockchain.info/address/14DZ3Yjb39sDTMwKd19Ly4PK15BKZfLXWZWhich is interesting, in that I revise my assessment the hacker was a savvy hacker. I was lead to believe that by the scripted splitting of the coins etc, which was in fact the work of the mixer service.
So the hacker could be any stupid lowlife opportunist scum-fuck halfwit who got lucky raiding a dropbox.
bitmixer.io are party in a $750,000 theft. If they have deleted all their records, then it looks like they are the ones who will have to do the time for the crime.