Possible scenario:

Someone noticed a spike on Sep 14th which was a Friday. Person A probably sent an email to Person B asking for information. Person B finally replied to ask person C on Monday. Person C gets looped in Tuesday and assigns Person D to take a look at it. Person D is finishing up a task and starts looking on Friday. Everyone thinks this is fine as the issue is probably just a front-end bug that's causing looped requests. It's not considered a security issue yet.

They make a little progress on Friday, but are out of town in Tahoe for the weekend. Monday the 24th rolls around and they finally figure out that it might be an attack and report back up the chain, a process which took 24 hours. Now it's the 25th, which is 11 days later.