Why would someone abusing this API stop doing so? If nobody did so for the two weeks prior to the fix, it's a very reasonable guess that roughly nobody did so ever.

It doesn't sound like the logs are detailed enough to prove the antecedent, though, so it doesn't really matter if the logic is sound.