I never implied that a system in that network was the origin of the traffic, but if a traceroute ends there then obviously SOMETHING at that location is involved, knowingly or not.

A search warrant leading to a malware infected machine is acceptable in my eyes. Again, tying traffic to a location is fine, as long as the correlation ends at the computer that originally appears to be the source of the traffic (even if it ultimately isn't) is all that is targeted until evidence can determine the individual behind it.