i would be kinda concerned, what else was done when the cable was disconnected, such as connect to a sniffer,and do some back n forth packet inspection as the client reconnects and starts torrenting again.
i really isnt good press to, lets say, accuse subscribers of Criminal involvment based on IP spoofs or hash collisions, so its a good idea to chase it all the way down to the drop line, and any pwnd boxes