If your servers were under constant attack, yes checking your servers every morning first thing could well be your routine. You also assume he immediately reco

If your servers were under constant attack, yes checking your servers every morning first thing could well be your routine. You also assume he immediately recognised them. It could well have been someone one who later told him what he'd found. Sloppy of the attackers to leave it in plain sight.