This is going to sound a little nuts
"server log and other evidence backs up that he is a far more likely candidate than brxbrx, matching user strings in the log file, knowledge of templates, css, etc."
CSS isn't a programming language. It's a stylesheet language to make stuff look pretty for marke-up languages - or somthing like that. That's like saying morse-code is a language.
All I can say is that the user agent strings from when UHM deleted stuff this morning are a better match for the vandal than the brxbrx were. Also brxbrx never should any competency or knowledge with setting up and using templates. UHM the first thing he did was start coding templates. Therefore, between the two individuals what evidence it is possible to gleam UHM is the better match than brx.
That said it does not prove anything. Personally I don't really care, I got a kick out of the the little back-and-forth with the vandal and the spamregex. I know a lot of other people took it a lot more negatively than me though. I think it would have been better if I hadn't have been at a family egg hunting pagan festival that day.
And anyway my interactions with both brx and UHM are limited at best. I am not even sure what the conflicts are about on either side. I am neutral though I stuck my vote in on the ban just to drop the info I had. I actually like Nutty Roux idea more.