M&S has found the likely culprit behind its cyber attack and a government intelligence agency is now on the case - but the retailer and its customers still face major challenges