There you go, I agree. That is #1 on the list of likely explanations. However, Knight has been known to step over the line, just like Citadel, so I don't give them much credit for simply having "...sold more than they bought" - I would add that it's intentional.
These MM's make money on their "market making," and they are given a lot of latitude by the SEC. They employ certain algorithms to execute trades, and they do a lot of tricky things with these algos. They go as far as they can go without a) getting caught, or b) exceeding such a level that it's worth it to the SEC to i) investigate, and ii) prosecute, or c) doing it so predictably that they can be easily caught, or any number of other lines they may draw to limit culpability or liability with their manipulations. They've been sued by the SEC many times, they've settled cases by paying fines, but they still continue with their manipulations.
I forget what the most recent proposal was that I came across from one of the major dealer-brokers, but the proposal was to the SEC, and they wanted to be allowed to effectively "spoof" buy/sell orders by creating/using an algorithm that would yank orders before they get executed if/when it suits them... saying that it would help make the markets function more smoothly. REALLY?!? What a crock! That's called SPOOFING!
Here, for years retail traders are chastised (if not outright threatened) by dealer-brokers if/when they spoof trade orders, threatening that it's illegal and constitutes stock manipuation and could result in stiff penalties including substantial fines and imprisonment, and now they propose that the SEC allow THEM to do such manipulation - to THEIR advantage (for making money, probably in combination with their currently existing SEC-authorized "market-making" algorithms).
No wonder some number of retail traders wanted to band together against wall street. Now they just need to find a way to put it to the naked-stock-shorting MMs, now that they made an example of a few micro-stock-shorting hedge funds.