Hi Adam
First of all - very sorry to see this. Hope you can get them back on their feet.
For something so dramatic, for me it's only ever one of three things:
-
A manual penalty (as notified in GWT)
-
Website has been hacked
-
A penguin penalty
I think with points 1 and 2, you might have already ruled this out, but be absolutely sure. Run every check under the sun to see whether the site was compromised, look for odd URLs that have been created, check Joomla/WP updates (and plugin updates to make sure they're not injecting malicious code) - just anything.
So that leaves us with point 3 - and I know you've mentioned you've looked at the backlinks already, and apologies in advance if this advice is like teaching you to suck eggs. Have you tried every backlink source, not just Moz, but WMT, Majestic and Ahrefs? Have you used tools like Kerboo and URLProfiler for quick classification of the sites? Have you checked the anchor text distribution?
The big calling card for me is the brand name drop - and that the majority of the time relates to a link/spam penalty. If you want, you can PM me the URL and I'll quickly pop it into Majestic and Ahrefs for a bit of further analysis - if anything just for a bit of sense checking.