You can keep guessing what happened or do what Richie said and start trying to figure it out. People who were hacked should prepare a report with the details about their os, installed software (especially wallets), e-mail provider etc. This is the only way to find a common denominator.
So far the only common denominator has been Bittrex.
It seems like a 3rd Party should be called in to investigate everyone's claims.
As far as the local PCs, you guys should make an sector by sector Image backup of the whole drives, to preserve what is called the Chain of Evidence.
In case this goes to court, you can contact a lawyer to verify that.
Bittrex should give as detailed an account of what they believed occurred with a Timeline of the occurrences.
For example :
If their logs show the trading went on, when the user knows his PC was Off, we know the Local PCs were probably not compromised.
But Bittrex should have detailed Logs of the IP Addresses and Times, plus what coin addresses were used.
Also Direct Question for Bittrex, this was a cyber theft , what law enforcement agency will you be reporting this too, as the victim's should receive this contact info so they can talk with the investigator.
