I'm pretty sure at any given RSA conference there are multiple folks who might personally/privately identify as members of anonymous, ie. they wouldn't need to "sneak in" to the conference b/c they are already there as legitimate members of the security community. <pure-speculation> Hell, there could be employees of HB Gary who think of themselves at anonymous. This would support your speculation that HB Gary made the sign, but complicate the motivations. </pure-speculation>

I do agree that HB Gary should be investigated as much as–if not more than–anonymous since there is some evidence of illegal or unethical business practices in the released email. I would like to think that we hold corporate security companies up to a higher standard of practice...