However, Framewood claims a theft on December 26 while running a 0.4.4 client and this theft occurred BEFORE EpicThomas posted poisoned links on December 31. This is evidence for possibilities 3 or 4 above and this evidence should not be ignored. This evidence is trying to tell us something and I am not sure what it means.
In regard to scenario 4, it is important not to forget that the reports pointing to a potential bug are from situations where the actual owner was sending NXT, which magically appeared in a different recipient account from the one entered in the client. These situations are very different from the reports that led to the hacked version, where the owners just saw their NXT leave their account without initiating the transaction themselves.
In other words, evidence is pointing to two totally independent issues that just surfaced at the same time OR the hacker in scenario 3 will be getting an even better kick out of this post! As far as EpicThomas himself... it is really hard to say. Just don't be too hard on him regarding the situations that might not be related to his hacked client.
I will read your correspondence with him very carefully and if I catch anything that might point to his client NOT being responsible for EITHER of the two reported issues, I will let you know.
Ricky can you. track down drexme as well? He absconded with the nextcoin donation acct with 33k nxt in it