If they were having a DDoS, they might have played with some routing table entries specific to their servers. An entry may have cached too long in a router, and then refreshed on a router reboot.

Before being assimilated into SBN, my brother's site was attacked. After repelling it - no idea of the specifics, but it did involve temporary routing entries - they returned routing to normal. The site still wasn't available from a bunch of ISPs, though (for me, vzw yes but comcast no). It took some sort of manual intervention to get the route update out - after way too many phone calls...

-jk