I'd recommend allowing 2 digit exploration. I've used it in the past when analyzing hard drive failure logical block addresses.
in which ways would the list of hdd bad blocks be faked?
In my scenario, I simply had access to a massive data set of hard drive sector failure LBAs, and had just read about benford's law on Slashdot (back in the day), and was skeptical that benford's law would actually fit this data.... so I tried it. And the data fit benford's law perfectly - with a single digit. When I tried it with 2 digits, and again, it fit perfectly - except there were two spikes which stood out. Curious, I started digging in... it was an interesting failure mode.