Yeah I was following those other addresses as well.
I dude that those address belongs to the hacker... (¿mixing btc?)
When looking at the transactions for the "mixing", I noticed the "Relayed by : Blockchain.info". So I wonder if the thief was dumb enough to use a wallet on blockchain.info, or use their (authenticated) API to broadcast them...
Of course it is in violation of the Blockchain.info privacy policy for them to disclose what they know about those addresses, or IP logs of associated API accesses, but if the law gets involved, I hope they will be able to cooperate.