Yeah, exactly - this "look at a 10 day period and extrapolate" idea is based on the assumption that the rate of hits to the triggering pages was constant over t

Yeah, exactly - this "look at a 10 day period and extrapolate" idea is based on the assumption that the rate of hits to the triggering pages was constant over the whole time, but in the case of looking for a malicious actor that's essentially begging the question. If there was unnatural traffic in there you can't assume its rate would have stayed constant over the whole period.