> One of the things I'll never understand was why the attacker was replaying my traffic? They were clearly in my network and could access everything without being detected, why replay all the HTTP requests? So odd.

Did you determine if POSTs were replayed? As in, logging into accounts and sending payment info and account info?