Do the math. 1.3 million gal tank. If they put in 1.5 gals of lets say poison, it would still only be 1 part per million.
By weight we are talking about 10,400,000 lbs. It would require a 10 pound sack of contaminant to equal 1 part per million.
Remember also that water is leaving and entering the tank at the same time further diluting the contaminant. It really is more difficult than one would think to effectively poison a large water supply.
That does not mean, These idiots should be taken lightly.
It does mean, however, that we should keep these "scares" in perspective.
Anyway, potassium cyanide is relatively cheap to make, highly toxic, and readily soluble in water. LD50 for KCN is 10 mg/kg, or thereabouts, so to make 1 8 oz. glass of water highly toxic, we want to shoot for 680 mg/glass, assuming a 150 pound (68 kg) person. To contaminate 1.3 million gallons to that extent - ignoring for a moment the issue you raise about dilution from water flowing into and out of the tank - would then require just over 14,000 kg of KCN, or about 15-1/2 tons of the stuff. Which is, to say the least, a little bit more than you're going to haul in a backpack. A really sophisticated attacker might try a biological agent rather than a chemical agent, but in that case, you're way beyond what someone can cook up in a basement lab.