...
... I have articulated my theory previously but after some weeks thinking about it I am even more convinced that it went something like this: TRM needed a last name to put his scheme together, OR, he simply understood that he needed to sit at the back of of Wheaton plaza and watch for potential young kids to walk through the woods. He could spy them come in without parental protection and know their approximate routes home.
If you parked by Wards you could inconspicuously watch children approach the mall and not be seen. I do not remember a way to drive through to neighborhoods from that part of the mall. TRM did not need that kind neighborhood access, he only needed a few minutes head start on an unsuspecting victim(s).
If the kids had mentioned their brother at the mall he could have lied to them about him, saying, "your brother got hit by a car and the police need your help". I imagine that a distant siren in the background could have helped in his vile deception....
... Maybe their tormentor was transporting them, but it seems so unlikely.
Your scenario is quite plausible and possible, although there is room for speculation and variation.
I agree with you that TRM was likely seeking any and all information from the girls that he could weave into his subsequent abduction plan. Information regarding family specifics, home location, route, time expected home, willingness to talk, etc. - all would have been useful information for him. He may also have stated to the girls that he knew their parents, or went to their church, or worked with their Dad...etc.
Although it is possible that he got a last name and looked it up in the phone book, I do not know for a fact whether Lyons had a listed phone number in March of 1975. It might have helped TRM, but would not necessarily have been a show stopper one way or the other.
I agree that TRM was likely also the abductor of the girls. He probably had done some driving around the neighborhood so that he knew the streets and how to get in and out quickly.
By the way, there was no road which directly connected the Kensington housing area to Wheaton Plaza Shopping Center. The girls were able to walk there directly because of a foot path which joined the residential roads to the parking lot. A driver would have to exit through one of three places, go out onto busy four-lane roads, and then enter the Residential Area through one of several residential roads.
In this case, the fastest automobile route from Wards to an intercept point would be to exit the parking lot by way of the North exit/entrance onto Viers Mill Road, heading west, and then make an immediate left onto Drumm Ave. This could happen easily and quickly, depending on the traffic situation.
Actual "abduction" would have been best achieved through deception and a believable story such as the "accident" or "hospital" scheme.
To speculate for a moment, it might have gone like this: TRM might have learned from the girls that their father was John Lyon the famous radio announcer. He might have said, "Oh, I know him well. Is he home today? I might drop in to see him."
Later intercepting the girls, TRM could have said, "I just came from your house. Your mother has been in a bad accident and your dad asked me to come get you and bring you to the hospital. He is on his way there with her now." The girls having "met" TRM earlier, and having become somewhat comfortable with him, would be less suspicious of his story and offer of a ride.
Again, the above is pure speculation (since nobody actually saw the girls getting into a vehicle) but such a scenario might have worked on the girls. Once in his vehicle, the escape route would have been quick and easy as you point out.
Exactly WHERE the abductor took the girls cannot be determined, unless other factors and information can be known or other connections made. Just about any direction away from Wheaton Plaza is possible.
Regarding the IBM man's report of a possible sighting of the girls two weeks later: The man probably was reporting what he saw. And, of course, it is possible that he actually observed the abductor with the girls very early that morning of 7 April 1975 ...
But it is more likely that what he saw was either a hoax, or perhaps a misinterpretation of something innocent.
For instance, there were a number of hoax callers to police and to the Lyon house throughout those days. Some clown might have though it a good joke to pretend to be the abductor with victims in the back of his car.
Or, The driver of the tan Ford station wagon might have been a father of children who had been driving through the night with them sleeping in the back of the car. Seeing a glimpse of a child rising up in the back window of the station wagon, after seeing and hearing reports of the Lyon sisters for two weeks, the IBM man may have read more into his sighting. There was another newspaper story which mentioned a Blue Ford with bumper stickers being sought by police. This was later determined to be a car owned by a woman who had two daughter of the same general age and description as the Lyon sisters.
From what I have seen and read about this case, I would give the "Tan Ford Station Wagon" story about a 50 - 50 chance of being an actual Lyon Sisters sighting.
I would give a much higher probability to the TRM story being a viable clue in this mystery.