I thought yesterday that perhaps the attackers were burning an exploit they had. This makes sense only if that exploit would have been going away with the introduction of the new Twitter API, or something. Obviously this is ruled out due to what we know now.