How did a differing timestamp cause an incident in the first place? Curious.

My guess is it was the only obvious evidence of an attack.