It's not an election unless it's 100% auditable.
And also show enpoints (via MAC and IP addresses) the election devices connected to. MAC can be related to a particular hardware manufacturer and IP related to a particular subnet and host. Lots of potentially damning info in those logs. Of course, these days there are sophisticated spoofing methods - but perhaps they didn't think an investigation would require such spoofing.
... and thinking about it for another minute, all they would need is the routing tables from the first hop routers the Maricopa county routers are connected to the internet with. They could subpoena their connectivity provider for their logs. Filter via their management software system to exclude personally identifying info - if it even exists in those logs - and nail them to the floor.