If I understand things correctly (and with due apologies if I've got this wrong): the first "wave" of bans was caused by backups missing DMI, PFI etc. Regardless of whether the box was connected to XBL, the 360's kernel would spot the missing components on the disc and mark the console for banning. The next time the user connected to XBL, the ban 'order' was uploaded and the console banned shortly afterwards.
However, this time - assuming the theory is correct - MS is checking for specific data on the disc. Would it make sense to assume, therefore, that the SS check can only be done when the user is connected to XBL - uploading the SS of every disc booted to XBL for checking against MS's master "known good" list? *If* the SS's are being checked, the only other way I could see them doing it was holding a cache of "known good" SS's on every 360, perhaps auto-updated when the user signs on.
A question worth asking would be: was anyone banned after playing backups _offline_?