About the passports.

So far I think "only" two statements are likely to be factual:

1. There were two passengers flying using stolen passports
2. Both were stolen in Thailand.

Certain other details would be informative and I am sure the investigator will look at those.

1. Time frame between the two thefts (one was reported Aug 2013)
2. Location of the two thefts. IIRC there was an armed robbery of a hotel in Thailand around that time where three passports were stolen (along with cash) from safety deposit boxes at the reception of a hotel. The name of the hotel escapes me, but I think it was either Dynasty Hotel or Lek Hotel, but near top of Soi 13, Beach Road, Pattaya.
3. Did both these passengers have same departure and arrival airports
4. Did the both of these passengers book on or near the same day and/or use the same agency?
5. If a destructive device may be suspected to be on the belly, did any of them originate from an airport with possibly insufficient screening and transfer in KUL.
6. About a potential problems with Chinese immigration. That may be completely irrelevant if destructive was intended on the ship.