DO NOT send unsolicted mail to this list. Turns out that one of our employees is a Media One customer. He has a Linux box, but dynamic IP address and tried to telnet to his machine, but the address had been reassigned. I was civil to Media One about this, and they consider the whole thing closed. I guess a lot of the customers get scanned and attacked more so than the companies.
Diligent customers send in their logs to abuse, and then they take action from there.
Finding entries would definatly be easier. From one of the emails discussing the legal ramifications to the sysadmin if an attacker launches attacks from the sysadmins machine, I looked into other possible problems for the system admin. In some companies it's automatic termination if the company can't recover a server. A couple of times is excusable, but many is not. I heard that sysadmins can be held legally responsible for systems that fail.