Given the "leetspeak" file names mentioned, this smells more like a bot or malware than a smoking gun for collusion, or lack of competence rather than malice.

Given the "leetspeak" file names mentioned, this smells more like a bot or malware than a smoking gun for collusion, or lack of competence rather than malice. On the technical side, how could this work? How could a third party create sub-domains and control their DNS?