So the banner must have been placed there after the server was seized. Keeping the server running long enough to gather evidence of the actions of their high-value targets was probably a higher priority than sweeping-up as many customers as possible.