1.) there are static routes going to places they do not want anyone to know about.
2.) they had tunnels set up, again going to locations they do not want anyone to know about.
3.) the logs haven't been cleared.
4.) users aren't normally a big deal as pretty much everyone uses the same logins.
5.) last possibility is the routers are something like pfsense on a supermicro, a LOT of info can be gleaned from something like that
So a few things here:
1.) there are static routes going to places they do not want anyone to know about.
2.) they had tunnels set up, again going to locations they do not want anyone to know about.
3.) the logs haven't been cleared.
4.) users aren't normally a big deal as pretty much everyone uses the same logins.
5.) last possibility is the routers are something like pfsense on a supermicro, a LOT of info can be gleaned from something like that