> Curious what logs they had to prove this! My guess is the client sends some kind of "goodbye" message when it gets reconfigured to another coordination serve

> Curious what logs they had to prove this! My guess is the client sends some kind of "goodbye" message when it gets reconfigured to another coordination server, and that message has enough information to determine if it originated from this attack.