As I understood luke might be trying to say funds from his hot wallet and cold wallet were co-spent in the same txs. The question is that hackers tend to sweep ASAP, not take the time to construct a complicated signing tx from multiple priv keys. The chain seems to suggest to me that he's been using a hot wallet from his defunct mining pool to receive donations.

Lots of questions not answered.