People being hacked since the last Server Check.

There are only a finite number of ways to hook into low-level keyboard input.
There are also a finite number of ways to rootkit the system to hide.

A remote access trojan is just a client-server app. They're not distinctive enough to be universally detectable.
The other two are, so even a keylogger using a root kit can be detected by a sufficiently sophisticated AV.
I can write a keylogger in ASM in minutes and a good AV will at the very least throw a warning because the code isn't signed by a trusted authority and is trying to do something suspicious.

All three require a delivery mechanism to execute & install.
Both capture methods would also require the victim to log in and use those credentials for them to be recorded.

Circumstances and evidence do not support the premise for the majority of the cases that are inexplicable.

Do you have any idea as to what might be going on? Even if you're not sure, what do you think is the most possible reason / combination of reasons for this?