They noticed funny traffic. And then did their due diligence by contacting both the vendor and a third party to investigate it. The investigation turned out fine.

What else would you do? "We found suspicious traffic but ultimately couldn't substantiate wrongdoing, should we torpedo the whole contract sir?"