From what I can see there are two bits of evidence other than IP logs: 1. Russian metadata on some of the files was added, implying it came from (I believe) a

From what I can see there are two bits of evidence other than IP logs: 1. Russian metadata on some of the files was added, implying it came from (I believe) a known Russian government actor. 2. The timing of the attacks match that of business workdays in Russia, including a cessation of attacks during official holidays. Now, if we were talking about a hack of NORAD or something , i.e. a hard target, where the pool of actors that are likely to be successful at hacking the target is low, then this circumstantial evidence could be reasonable. The problem is that, from what we have seen so far, the DNC server and others were poorly secured. This means that the pool of potential hackers goes from "nation states" to "skript kiddies and up" and as a result, circumstantial evidence is much weaker.