Suppose someone is unfortunate enough to have his computer taken over by a botnet which eventually causes it to self-destruct after having functioned for awhile, unbeknownst to its owner, as a child porn server. How much effort would you make to determine whether such a thing had happened, or to preserve evidence that it might have done?
An experienced forensic examiner can find evidence of such activity. The scenario you describe would be pretty easy to prove or disprove. If is was a botnet and was just using the guy's hard drive as a server, there would be no evidence that anyone actually opened the file on that system. When a file is opened, as opposed to being copied or downloaded, link files and other traces are created all over the place. That is just one fast way to tell, but there are others.
Trust me, if I was tasked to examine a case like that, I would make every effort to prove whether the pictures were deliberately downloaded and viewed. If I could not, I would say so, but I would try to validate any other possibilities as well.