Great analysis!
You also mentioned that addrman will not evict the spam until 30 days after the attack ends. Since your data stops on 12 August, I checked the public demo.peer.observer addrmans (hal / len) and posted an update in #155. You can see the turnover spike there. If you have later snapshots, you could check whether “new addresses added per day” jumps the same way. I’d expect this to settle back toward the old range over the next few days.