It is a huge stretch- at least partly because there is no third party verification that Adria's blog is actually victim to a DDOS attack, as far as I know. I'm not accusing her of lying, just that "a huge, huge number of people reading your blog post" can look a lot like a DDOS attack if you're running an unoptimised version of Wordpress, or similar.
It's uncharitable of you to assume she can't tell the difference between a botnet and a spike in traffic. The "third-party verification" is that her site came back online after implementing CloudFlare's DDoS mitigation.
It's uncharitable of you to assume she can't tell the difference between a botnet and a spike in traffic.
I don't think so. It's incredibly difficult to tell the difference, given that a DDOS is a huge spike in traffic.
Real users load CSS and images, run javascript, stay on the page more than a second, etc.
Not when they can't load the page, they don't. Once a traffic spike overwhelms the server no-one sees any HTML, downloads CSS or stays on the page.