People being hacked since the last Server Check.

Personally I think it's more a matter of just sending the right packets to the server at the right time to make it think the login server approved you, or like the switch hack, to make it think person x is actually person y.

The number of people entered without any changes to the login info is too high for a password reset manipulation to be the only thing out there.

I'd say that's a good guess. Much more likely than someone somehow getting ahold of people's packets as they route between their client and Nexon's server. Or reading off the value of people's computer memory.