It's really unfortunate this has happened to you! One thing you might want to check for is compromised / hacked content as well, since here in the Moz community (and in-fact the wider SEO community) we are seeing increased instances of negative SEO combined with hack attacks
Another thing, you have to be really careful when updating your disavow file. If you don't download the existing disavow file first and add your entries on to it, then all of your prior disavow work will be undone. When you upload the disavow txt file, that is your COMPLETE disavow, not simply some additions to it. So if you handled that wrong, you may have disavowed the new stuff and un-disavowed loads of legacy work (which could land you right back at square 1)
In general, disavow work does not result in increased SEO performance. If a load of sites were giving you boosted SEO metrics, and then Google decides they are bad and nullifies them, doing a disavow doesn't magically make Google give back SEO authority that you should never have had in the first place. Those pipelines are severed
Have you considered that in its early stages, a negative SEO attack often actually boosts rankings? Then, when the network is uncovered, that juice is all cut off. Maybe the past positive performance, wasn't all down to you. The negative SEO attack (before it reached critical velocity) may have been boosting your rankings. Now that it's flipped negative, most of that SEO authority will be cancelled out. That could be a bitter pill to swallow, but I have seen it a lot of times
Maybe this drop in performance, is actually where the site should be ranking under your own efforts. If the negative SEO attack initially went undetected and boosted certain rankings, then was discovered and spun around - then actually you are where you should be. Could be complicated to explain to an enraged client though
The reason you process a disavow file, is to list all the spammy links and disavow them, so that Google will not (in the future) give you a manual penalty which nullifies all (or most of) your rankings. Since you don't know which links Google currently does or does not consider to be spam, this inevitably results in a few non-spammy links (which were contributing SEO authority) getting nullified, which makes results go down NOT up. What a disavow does, is trade a very small amount of your current performance away, in return for mid-term insulation against manual actions (which believe me, are truly horrible)
It never ceases to amaze me how people don't understand what disavows are truly for and how many people say "hey I did a disavow and I saw slight drops and no gains". It's only under very exceptional circumstances (like manual actions) where disavows can potentially (if they are accompanied with linked Google Word Docs, explaining in detail what has happened to Google, through a reconsideration request) result in raised rankings. 99% of the time they just insulate you form things getting worse and give you a very slight results dip
One thing you may want to look at is if your disavow was too aggressive. Spam can mean different things to different people. Did you download all links from all tools (Majestic, Ahrefs, Moz, Google Search Console), re-crawl them in SF to see if they are all still live? Did you then fetch metrics (Ahrefs URL Rating, number of linking domains to each URL, PA and DA from Moz, CF and TF from Majestic, Sessions from domain from GA) for all URLs using service APIs and URL Profiler / Netpeak Checker?
Did you put all the metrics against each URL in a massive spreadsheet? Did you normalise and boil the metrics down to a final score to see which links have good SEO authority, and which ones don't?
If you just looked at them with your human eyes, if you only looked at links from one backlink source without doing a master de-dupe from all backlink data suppliers, then you probably didn't do something anywhere near extensive enough to clean up properly. Cleaning up a negative SEO attack properly with minimal risk, is a huge undertaking that could take an expert around 5 days to compile and update the disavow file
Remember you're dealing with an algorithmic devaluation. Algorithms see in numbers, not with your actual eyes. If you didn't have a data-led approach to your work you are extremely likely to continue suffering in the mid to long term
I would go over the work again much more forensically
Finally: Remember that Google and Moz aren't connected data sources. DA (Domain Authority) is NOT used in Google's ranking algorithm (at all). It's an estimate only (to replace Toolbar PageRank which Google took away, and stopped SEOs seeing). Even TBPR wasn't great, but it was at least aware of disavows, Google penalties and algorithmic devaluations. Moz's DA is 100% unaware of these things and doesn't factor them, so if you are looking to DA to save you - or for things to 'just get better' over time - think again!