I have to be honest: I don't understand any of these events. The 2 explanations just kind of restate the short description without adding any additional insight.
What's missing is this: what are the signs in each of these events that something malicious was happening? The fact that EOS moved isn't malicious, necessarily. The fact that someone bought RAM isn't inherently malicious?
What's indicates maliciousness?