The pool owner said that user had connections from 15k IPs.
It's without a doubt a botnet.
Watt 15k IPS? definately a bot net then but wouldn't the user know if the pcs are compromosed?
I would guess hiding Burst mining is much easier than CPU or GPU mining.
You only notice that you don't have much free space (depending on how much space is being used, likely not all of them) while CPU/GPU mining causes lags and fan noise due to heat so it's easier to notice.
And I'd guess you could Burst mine even on stuff like Raspberry PIs or even smartphones without their owner easily noticing them.