The timers are allowed to drift, as you can see here:
http://antminepool.com/explorer/XVGB
things look great.
as you can see here, from the attack, they did not look so great:
http://antminepool.com/explorer/XVGB?start=2030000
you need to look at the difficulty the blocks are being mined with, they use to be 0.001 and now they are correct. no longer exploited so the fork has worked and it fixed the exploit.
After the update went out to the pools and exchanges at block 2040000 you will see that the exploit is no longer working.
http://antminepool.com/explorer/XVGB?start=2040000
the fork has been successfully completed at block 2042000 but if you check the blockchain one can tell that no more blocks have been mined using the exploit from 2040000 onward.
http://antminepool.com/explorer/XVGB?start=2040000
if you were to assume that all the block from when the attack started at block 2021000 up to block 2040000 that would mean 19000 blocks have been mined using the exploit.
19000 * 1560 (block reward size) = 29640000 XVG maximum that could have been mined. Again this assumed that all blocks were stolen which isn't the case.
Hopefully this answers some of your questions, as for what happens to the addresses where all these exploited blocks went to....we will have to wait for the official update from the verge team.
As i understand it some addresses might have been blocked with the exchanges and possibly as part of the fork. (don't quote me on this)