Ok, here is a snippet of login history that absolutely identifies MrCopper as doing this.

User - Time - IP - Clan

mrcopper - 2013-10-16 01:03:35 - 24.74.144.201 -xRDx
++ hundreds of logins on this IP as Mr Copper before this

<lcn_user1> - 2013-10-16 01:11:29 - 24.74.144.201 - LCNostra
<lcn_user2> -2013-10-16 01:10:12 - 24.74.144.201 - LCNostra

CRAP I'M ON NOT ON THE OTHER IP!!!!

<lcn_user1> -2013-10-16 01:13:36 - 93.115.82.54 - LCNostra

The IP's in that 93.115 range also did the injection attacks.