Toxic Links from the Bermuda Triangle

Hi guys

Got a question for those with a wiser head than me. I've got a small SEO client who I've had for about 6 months. They were getting solid (if unspectacular) results for the last 3 months of last year (2013). Incremental growth but certainly trending in the right direction.

Anyway, recently their site has plummeted in the SERPs, which caused me to go all CSI to try to get the bottom of what was the cause of their drop in rankings. And that's when I discovered they had over 3,000 toxic links.

Naturally with a link profile like that there's an angry Penguin afoot. Okay. So far so straight-forward. However, looking at their link profile (via Raven), all 3,000 toxic links have been discovered by Google since December 30, 2013. And naturally I've not built any toxic links during this time (or at all).

But here's where it gets interesting / confusing. Going through the links one at a time (a mind numbing task!) I've discovered that they are all the worst kind of comment spam, and were all done IN 2010.

When I first started working with the client (October 2013) I did a full audit of their site and back link profile and they had maybe 200 links (all good / natural - if low value).

I brought these mysterious toxic links up with the client and discovered that back in 2010 they hired some dodgy Indian company on the cheap to do their SEO for 6 months. And so it's not hard to figure that they were the ones who built all the toxic links. But...what I can't understand is a) why weren't these links getting registered by Google previously. And b) why are they only now suddenly appearing?

The only variables I can think of that are worth mentioning is that in late December we installed a new WP theme (as their old site was outdated) and re-submitted the sitemap via WMT.

But unless a WP template can go back in time and create toxic links, I don't see how it's got anything to do with the new theme. But given installing the new theme and re-submitting the site to Google happened just before (give or take a week) these toxic links started to appear, surely that can't be a coincidence? But again, I can't see how that would make any difference or why the toxic links weren't being crawled before (they're from multiple different TLDs).

Anyway, I'm completely thrown by this, as I don't know how to explain it to the client. Or for that matter to myself!

Any help / suggestions would be greatly appreciated.

Thanks!