Having a list of people who visited the site (possible via DNS records) is definitely a way to drastically narrow your suspect pool. Now you don't need to be a global passive adversary - you just sit on the links used by the "bad" people.