What makes you tell it looks like DNS poisoning? It if were DNS poisoning, some resolvers would have been poisoned but not all, while, here, everybody saw the attacker's IP address. http://www.bortzmeyer.org/observations-wikileaks.html
Your analysis looks pretty good but I disagree that DNSSEC would have stopped the attack, because many users don't use validating resolvers.