Yeah maybe, but in the “report” they issues in January, there were no indications given that they had precisely tracked the hack via NSA data, and given the alternative possibility (a leak), it would seem that at some point in the process a forensic examination of the actual server would be necessary, if only to eliminate that possibility.