1. As far as I can see, the transaction that funded the double spent inputs was done earlier tonight and was not included in a block until hours later.
It has insufficient fees. Given its size, it's a wonder it confirmed at all.
2. The attacker then spent many of the inputs immediately after they got into a block with a 0.0001 fee. This fee was as far as I can see acceptable according to
https://en.bitcoin.it/wiki/Transaction_fees . Spent coin age = 1, sizes of the double spend transactions all below 300 bytes resulting in 0.0001 fee in order to get relayed. Here, I see no reason why the transactions wouldn't be placed in the queue to be included in the next block on almost most mining pools out there.
Those transactions have dust outputs, and are therefore non-standard.
3. Roughly 10 mins later he double spend some of the inputs, now with a 0.0005 fee. (If I'm not missing something)
True. These transactions also have the benefit of not being non-standard.
There's nothing unusual about this double-spend attempt. Note that a double-spend is only said to "succeed" if the party receiving it is defrauded by believing it to be valid (which isn't the case here, as the payout transactions are invalidated by the double-spends).
But I think it's the best you can get. Well not the best - you could try to "override" it by yourself by reusing some of inputs in transaction with high fee - that will be likely accepted before that old one with regular/no fee. 
