Just because you don't see massive spikes, does not mean it's not a botnet. He can easily have so many infected throughout the country that it won't fluctuate as much.
http://www.bbc.co.uk/news/technology-25653664
Not as others wake up. We're talking about 500mhash.
If he is doing a very low intensity as to not draw attention to UI lag, lets assume 10-15khash per machine...you can see how many machines were talking about spread over the country.
I'm sorry but this is just a much more likely scenario, that is already proving to happen, versus a company testing new secret half million $ asic mining farms on a public pool.