Having a little bit of trouble parsing how the attack worked -- so when a transfer happens, the destination account gets to run a command; they then ran a command that called the source's send-ether command, which ran because it was still in 'we owe destination account money' mode because the full initial contract had not concluded?
Then at some point it terminates itself before emptying the source account (and thereby causing a rollback that would cascade back?)
Then at some point it terminates itself before emptying the source account (and thereby causing a rollback that would cascade back?)