Seems to be a good analysis but being in Mumbai since 2 years I doubt that people were not from Indian origin and anybody who stays in Mumbai even only for 6 months knows how Mumbai actually operates. Local trains are literally heart of Mumbai's life and even one time visitor knows this.So they must just have planned that they will attack on India's financial capital. And that is it.4-5 people from their group for 6 months in Mumbai is sufficient to plan everything. How would have they implemented this plan is an all together diff issue they might have taken help from ppl sitting outside india in terms of money and political power also.
Overall in my opinion those people are still im Mumabi itself and as you said they must be atleast 25 in number so we should be able to catch atleast some of them very soon.Seeing India's growth in every sector we all know that Mumbai is really very sensitive part of our nation, measures should be taken to keep a check on everyone coming inside Mumbai.May be it is very difficult but what else we can do?