Proving what, exactly? That a Mini makes a dandy bookend no matter what platform the books are hosted on?
Anyway, all this proves to me is that someone shouldn't use workstation OS to perform server workload. And who puts SSH on a public facing interface, anyway?
I like your bookend theory... but it may also indicate that he doesn't know as much about Unix security as he may about Windows.
The rest of your conclusions are spot on. And your question is a good one... and I suspect the answer is "Someone who WANTS his Mac box rm'ed so he can spread FUD about Macs."
So far no one has duplicated this exploit (not even Gwerdna) on another machine... and no one has posted anything to PROVE that it actually happened. This actually could be made-up FUD. I found it suspicious that this exploit occured on February 22nd but no crowing announcement was made until two weeks later.