I would say it was an Nmap -D scan (decoy) - to hide/obscure the attackers real IP address he can tell Nmap to insert spoofed IP's of the attackers choosing into the probes or have Nmap use random...