Many questions, many speculations, very little answers that bring us forward.
I think we have reached a point now where we have exhausted the information contained in the server logs (except if @eduperez is able to distill some new information out of the logs over the weekend).
I checked where we could complain about this issue, and it boils down to basically 6 adresses (the numbers are the current download counts 06...18.-JAN-2019):
If somebody is able to investigate this deeper, then it's the ISPs, since they know who is behind their IPs and how to contact them.
@thess How do you think about this?