They were probably spamming someone else and choking some network uplink at their provider, which is why the provider itself told them about the possible compro

They were probably spamming someone else and choking some network uplink at their provider, which is why the provider itself told them about the possible compromise. Either that or killing other resources and raising very simple alerts (disk, CPU, RAM, Ethernet ports, etc).