Infection via SMB fits
I think this would make sense much better than infection over email. The time frame just didn't make sense for infection via email. We've had this type of malware in one form or another for several years now. Time wise, the infections have been spread at varying levels over months and years. To get a (seemingly) synchronised attack going over a single day, just relying on people in hundreds of organisations all over the world all opening infected attachments at once in such a short window of time seemed from the beginning an unlikely explanation.