been there, burned that budget chasing internal ip logs. honestly most nat behavior looks pretty similar unless they got some serious session tracking going on, which is rare. if they claim no logs, they shouldnt be able to tie reconnects back that easily, but that depends on their backend...