Yes to both!

It makes sense that the packets return in an order that provides information, but we're talking about timing differences of a few ms; as tptacek says I would expect that there's some network jitter on the return path that has to be allowed for with timings this small?

Yet apparently not - obviously the attacks are working. Does he somehow know when the response left the server?