I saw the pool go from 70TH to 1000TH in minutes so I assume this miner was what
made the pool jump so much, they were/are greater than 90% of the entire pool hash rate
at the time, if this is correct.

The odds of them finding 7 blocks in a row was not that unusual in this case

But the odds for them not to find one "random" bonus share in the seven blocks
is a one in ten million event being 90% of the pool.

So my question is how can you know how many shares they submitted
but not which shares they submitted

How many times did you have to pick a random share every round before
you found one, that you knew know who submitted it, why did it take 5
rounds to realize that there was an issue with this.

cheers