I said this earlier but it was meant for you to see.
When did you tell the new Q that tor works and don't you think if you HAD made a significantly weakening error such as using dev data in production which rotated all salts BUT the whitelisted one by old Q, why would the new Q choose the WEAKEST moment in your site's history to choose to return without doing the STRONGEST verification he has done previously? It just doesn't smell right, it smells like you got compromised by a bad actor who cannot verify. You either told someone and they took advantage, or you're saying Q was observing and chose that moment when things are going sideways. I don't think Real Q would do that, I think Fake Q would.