We have no idea what happened with the first 3000 blocks mined that were the premine (0,5%). Most of the coins were allready mature and in wallets but when launch took place they just disappeared.
If coins would be stolen, you would see in your client a transaction transferring all those coins to someone else (and you would see the thief's account in the transactions).
If I am correct with a blockchain starting over just the genesis block without premine becoming longer than your blockchain with the premine, then the coins would "just disappear" (as the client would detect longer chain and switch to it, basically dropping all the premined coins without notice, though you may find some notice in the debug.log)
So it should be easy to distinguish these two scenarios.
. 
