We can't rule it out, no. Just comment that it does not seem necessary at this point: Moustache's doxing of scout/Cirrus shows that she could have been easily busted, we know that she was subverted early on (it was rumored at the time, in fact - 'emailgate'), once the account was taken over, then it is perfectly capable of de-anonymizing a server (de-anonymizing is really easy; I've de-anonymized or helped de-anonymize at least 2 blackmarkets myself, and actually, just today someone has found another way SR1 could have been de-anonymized easily, although I can't go into details), and currently the seller/employee busts are consistent with the Freedom Hosting attack, which no one needs to ascribe to parallel construction (since we know it was an obsolete NSA attack which got reused).

What if any steps do you take after de-anonymizing a black market?

If the operators seem reasonable, you contact them privately with the IP and point out the implications. If they don't seem reasonable, you post it on Reddit and destroy their reputation. Unfortunately, quite a few operators are fools, knaves, or both.

Based on the current public info, nothing can be confirmed completely or discounted completely.

Currently there are only two pieces that points towards the Sybil attack being used against Tor:

1. Some Tor Hidden Services were uncovered

2. The dates just happen to match dates a research project were running

But there is a lot more pointing away from it: the main points are:

1. The FBI already had a source in SR 2.0

2. It is easier to uncover hidden services using endpoint hacks rather than global deanon

3. Given the ability to deanon parts of the Tor network, the feds would have targeted the larger markets and got a lot more arrests. It isn't a coincidence they just happen to take down the sites with the worst software stacks, security architectures and operational techniques.