It only pays to watch access logs if you have a small amount of traffic to begin with. Do you think amazon.com would notice an average daily difference of 5k hits? I'd bet a paycheck that's within the realm of random fluctuations in their normal traffic. The problem CG is highlighting is also due to the shortened timescale of pentests. There's nothing preventing a real attacker from spreading those extra 30k hits over several months instead of just the week or two that a pentester has.