Having worked for awhile for a fairly large email service provider I can tell you that it is not always easy or quick to determine exactly what has happened in an outage. For example, the DDoS attack might take out a piece of Internet backbone that is not under your control and the company that manages that might not be very forthcoming about what is happening. Sometimes things just get messed up in such a way you never know exactly what was going on. I remember one time when emails were taking a really long time to be delivered, and we eventually learned that a large chunk of the Internet was being routed through some regional ISP in Russia, which was unable to handle the load. That seemed rather suspicious, and it fairly quickly went back to normal, but we never learned what made that happen. Here's an article on that type of incident:
https://www.zdnet.com/article/russia...re-and-others/