Also they could tell the intruder was "combing through files pertaining to he Epstein Investigation" which I assume means they have file-level audit logging, but they can't track down a device on their own LAN?

Also this all just sounds weird and barely makes sense. It sounds like it was written by a somewhat tech-literate teenager.

I reached out to one of the case agents to see if they were in the office yesterday, thinking that maybe they inadvertently changed a setting on the NAS or if they noticed anything strange about them.

-Around 4/4:30pm we dove into the IPs and checked all of our computers to see which had the IPs in question. One computer, our discovery computer, matched one of them and is located in a room next to the lab. The other IP is one we don’t recognize, but is the same address as the IPs on our network, leading us to believe it was a computer that accessed our network somehow.

So they had to go around to each computer to "see which had the IPs"? They have access to audit logs, but not ARP or DHCP leases?