...
Malicious user information:
IP: 79.172.242.141
Malicious address: http://blockexplorer.com/address/17JuYfk8bWUHvAfRv5eF7zUic1g3qrDobz
I believe this represents the majority of any bitcoins stolen from this attack.

I presume you've done it already, but the whois of that IP address says it is effectively one person.
So either they were hacked or they did it:

Not quite - google lists that as also being the registered address of this hosting company: http://www.1b.hu/
Perhaps VPN/Proxy/Tor exit node?

Even if it is a company - being so small: only 254 IP addresses, would mean they'd most likely know a lot about it.