> I suspect they don't have the forensic evidence to determine the root cause.

It said that. The terminal server entry point was completely scorched in the attack. Offsite rlogd would have helped.