Before revision:  We conjecture that this result can be improved to ] T^2 S \geq \Omega(N^3), and we show that it would imply a T^2 S \geq (N^2) tradeoff for Element Distinctness ]  .
After revision:  We conjecture that this result can be improved to Eurocrypt'20] T^2 S \geq \Omega(N^3), and we show that it would imply a T^2 S \geq (N^2) tradeoff for Element Distinctness ] .