I don't think you are missing anything. There's zero actually traceable evidence in this report.

Where are the web server access logs with source IP addresses and timestamps?

That's the kind of evidence that is needed to go to a provider's abuse department or sue to unmask the user behind a given IP, not attacker controlled (and falsifiable) strings.