They could also simply log all the information and have made the server appeared to continue to operate as normal, since most fooling with the DNS packets would

They could also simply log all the information and have made the server appeared to continue to operate as normal, since most fooling with the DNS packets would yield certificate errors for many sites (Google, YouTube, etc.) Most of the time someone comes out and says the BGP hijacking was an accident. A bit of a Hanlon's razor situation.