I'm willing to accept the possibility that this is just a coincidence, but it seems less and less likely to me.

The faxt that these bombs show up with other clients means that whoever is doing this is infecting the entire Gnutella network. If it does turn out to be somehow tied to Xolox, I think there will be a huge backlash.