This might narrow it down some, but I have been on weekend flights that I recognized people on the return leg from the away leg. But even going from 200+ people to 10 would help
The person doing it might not be on the affected flights. Instead they plant something on the plane during a different flight (or between flights if they are an insider who can get access to the plane between flights) that is hooked into the PA system and has a recording that it plays after a time delay or perhaps when the cabin pressure lowers or perhaps both (e.g., delay 48 hours than start when the cabin pressure lowers).
If the device had a long time delay or a delay based on the number of flights they might have to check many flights before the affected flight. And there is no guarantee the person would use the same delay each time.
If they pick flights on routes that have a lot of repeat travelers and the delays on the device make it so the airline has to look at a fews days worth of flights to get the suspects for each incidents then I'd not be surprised if there are may people that were on all the planes sometime before the affected flights.
The big problem I see with it being done by someone not on the flight is that surely after the first couple of times the PA system is going to get thoroughly inspected and the device would be found. The mystery would then just be "who", rather than the "how" mystery that we currently (at least publicly) have.
