When the network was spammed to try and bloat the block chain, was that actually part of the attack? Wouldn't you want to slow down the network and cause some transaction volume to slow as part of the prep work?
Maybe if you were trying to take control, a slower network, down to what you could manage, would be a necessity.
To counter the block chain spamming, was the fork to increase the fees an anticipated outcome for the attacker and something he was relying on, or was that a problem that required him to force another fork?
Although the events were some weeks apart, it is still quite a lot of attack activity in a relatively short period of time.
Happy to delete this post if you think it just promotes unnecessary FUD.
Let's address all this after we are done with recovery and have official builds up.