Update regarding Perfect Money;
We've taken the server in question completely out of rotation, and are asking Iweb to keep it as evidence.
Perfect Money have informed us that they have blocked the majority of the stolen funds. And we're now asking them what is the process for gaining information about the accounts Yan has sent the money to... We're hoping to get IP addresses linking to Yan, or at very least to Montreal / Iweb where Yan works (had worked).
* We'll also look into some of the PM accounts (if PM is cooperative) regarding some of the money yan stole previously via fake cashouts from hijacked accounts)... It should all link together!
With the circumstantial evidence + the physical server logs, and attempted covering up, along with the money trail. We'll hand that all over to the police via Iweb, and aim to prosecute Yan.
We found that when the programmers installed the new WWW servers, they ran a script that re-established Yans SSH access key. Which he has then used to compromise our PM password (though we need to check how he's done that, as the server shouldn't save that info) and send himself the money.
I'll post more info as we get it.
But fingers crossed! This might not be such a big hit after all. And if it lands Yan in jail, all the better!