> Interesting that traffic didn't return to completely normal levels after the incident.

Clients cache DNS resolutions to avoid having to do that request each time they send a request. It's plausible that some clients held on to their cache for a significant period.