I just want to second what paulmd wrote. I think the story is extremely unlikely to be true but it is almost impossible to provably clean a system compromised by a sufficiently advanced attacker.

Part of the problem was the combination of advanced claims and the breathless breaking-news pace of the discussion. I definitely remember people getting confused because the secondary or tertiary coverage had confused points like this as reporters rushed to publish and people often remember those with the same authority as primary sources.