Ignoring the fact that their NAT was apparently wide open with no domain rules, a simple dashboard over their NAT showing requests grouped by domain could've gotten them a long way.
Or just skimmed through the leftovers from each agent session.
Or just skimmed through the leftovers from each agent session.