You are right on the Maths. You are wrong on many levels on your modelling. Even if you were right on the modelling, you are still wrong on what conclusions you can draw from the results.
Your argument is "something could be wrong". My counterargument above is "even if that was the case, you don't have enough entropy to draw that conclusion". Smoothie's corrolary is "even if you are right, it doesn't make much of a difference".
My theory is BCX has the ability to manipulate either block lengths or the timestamps for minutes at a time.
In the days since the "attack" I've regularly checked block intervals to see if there is anything suspicious still going on, and there's not. So, likely there was some sort of manipulation taking place at the time and not now.
If you were watching Minergate like a hawk like I was you would have noticed the time between blocks was much more varied then than it is now.