Welcome to the Q&A Forum

There's not a whole lot to be done about other sites getting hacked, unfortunately - even if you did find the program/network that is creating the bad links, you might not be able to tell which competitor of yours is doing it, and even if you did it would be difficult to prove or get them to stop. Your client's site may even not be the real target - link spam networks will often target a variety of random sites in addition to their real targets to cover their tracks. The good news is that Google is pretty astute at ignoring these types of links. It's highly unlikely (though not impossible, unfortunately) that your client will see a link penalty from this malware. Here's what I would do in this situation: Contact as many of the hacked sites as you can/want to, and let them know they've been hacked (that's just a courteous thing to do, as it's likely the site owners have no idea, but it's up to you how much time you want to spend on this). Be proactive about disavowing as many of the spammy inbound links as you can find (you're probably already doing this, I'm just saying). You could probably do this at a domain level since it sounds like the linking sites aren't related to your client's site in any way. Take a little extra time in the next few months to build some high-quality links to your client's site to make their link profile a little extra shiny. Taking steps to guard against any damage/fix any damage that may have been done will be a better use of your time and effort than trying to figure out who's doing it and why, IMO.

He's giving you a nonsense number, because SEOMoz won't reveal the true scale, so use whatever logarithmic scale you want. ie. an indeterminate amount

Your google rep should be able to tell you more then any of us about why you got banned