"Anybody" who has the password to the Lulzsec Twitter account. Or who, very unlikely, hacked Twitter.

It's official in the sense that lulzsecurity.com endorses it (and @LulzSec endorses lulzsecurty.com), so either both @LulzSec and lulzsecurity.com are 'fake' or they're both actually controlled by LulzSec.

I think it's pretty safe to say that they're both controlled by LulzSec.

Does it matter really? For all we know different people could have been posting stuff during the 50 days all under the same banner.