A proposed solution for the attack which possibly might be viable is reverting the state changes that the attacker made to the contract, directly. As such, I’ve deployed a contract which should be able to do exactly this (link also below). The state changes are those listed in this transaction:
Please check it out and if possible propose. Let’s see if we can get it through, otherwise we’re fucked I would say.