But surely someone would have just checked the signatures on these transactions by now? (I would do it myself but I'm not familiar enough with the bitcoin transaction format.)
They're definitely invalid transactions. The public keys and signatures do not match the address they're trying to spend from. Only blockchain.info failed to detect this minor detail.