possibly because they defederated from some instances.

Yea the admins noted recently that whoever is running the attacks knows about lemmy's weak spots, so it tracks that it's a disgruntled user base. That being said, I wouldn't underestimate how easy it is for someone with a chip on their shoulder to figure out these weak spots, so it could be anyone really.