Given the three to choose from and told to make a suspicion roster, I would put CD first on the list. I agreed with his pro-roleclaim stance at the time, but he initially pulled it out of d3mon's post and focused attention on it.
ccabal and cao cao both talked against d3mon and both voted, but per my earlier post I have difficulty singling them out for that; I was fooled too after all.
I have a more newbish feeling from cao cao because he IS new. I dont know whether to interpret this as him trying to play below the radar per Kevin's suspicion, or simply letting the more experienced and vocal players (of which there were many) take the lead.
Ccabal joined the talk but didnt really distinguish himself, and he DID ask about finding a way to test d3mon's claim... that's worth something.
Actually, looking back I'm going to put cao cao ahead of ccabal for the following reason: ccabal had 2 votes on him, tied with KevinH for next-highest count. If he unvoted to spare d3mon and other voting/unvoting swapped to him at the last minute, it could have tipped him over the edge and resulted in HIS lynch. Ccabal therefore had a little more of an reason/inhibition against unvoting as it would potentially be at the cost of his own life, whereas cao cao had no such pressure to keep his vote in place. It's not a STRONG reason, but if we're grasping for differentiating factors at this point I think this is worth noting.
This is all we have to go on at present, and I dont have a strong anti-town feeling from ANY of them at this stage... but the vote record IS there and we have to start somewhere I guess. If CD is scum, then he played well/rationally on day 1 to where it never felt like an unfounded attack, Cao Cao similarly felt more new than anything else, and ccabal was just another voice. I'm hoping you're right about 2/3 of the scum being on that list kevin, because if not without our cop we'll have to start hunting from the rest of town based on votes.
TL,DR: (Too Long, Didn't Read = summary:)
1. CD
2. Cao Cao
3. Ccabal
-Preston