I would also contact the customer and inquire if there was a specific reason to issue X checks on the same day versus one. But with the non-customer bouncing from location to locaiton, I would say they are suspect #1. Now if the customer was assisting them by issuing these checks this way, and the non-customer cashed them in the manner described by the original poster, I would list them both as suspects.
I have seen Title companies issue more then one check to the same person on the same day at their customer's request. They typically would reference the same property address or similar in a way for them to tie the transactions together. If you have a reasonable beliefe that the customer was an innocent party, I would document that in my case notes as well in the event that an examiner selects that SAR case file for review.
If you can prove or reasonably suspect collusion, I would list them both, but if you have evidence to show that their customer requested these checks this way, then I would make sure to note that clearly in my notes and even in the SAR narrative.
Just a couple of thoughts.