Let's look at this from a different vector.
I don't use cgminer, but these miners come with a certain amount of remote management right?
Can affected users confirm these ports are exposed to the internet? Possibly you use it yourself to monitor your miner while away from the house?
Wouldn't it be more plausible an exploit was found in the miner's API that allows an attacker to issue such commands?
Try changing your API password to something much stronger?
That was my first thought also, that either the API or the API manager was breeched.
- open port for the API, API web management with weak or no password, etc
I have no open ports for API, or Web Management. I use PFSense for my router/firewall. I have a dedicated laptop with fresh install of Win 7 with Logmein, then SSH onto the Rigs from that point.