... Oh yeah, there's also the fact that the list of accounts and passwords was PUBLICLY RELEASED a week or two before we were able to get the mass-ban initiated, and we don't know who had access to it prior to that, meaning that in addition to the multiple cases of people logging onto other peoples' accounts and taking stuff that we know about, there could be many more that we don't know about.
P.S. See my addendum to your post.