I'm not sure what proof you guys would like to see. There would be no logs or "zombie sessions" (what...?) if it's a simple volumetric attack. And it's hard to estimate attack size without help of ISP. 5TB over 5 hours is about 2Gbps, FaucetBOX.com was hit with DDoSes of 1-10 Gbps, it sounds plausible.
That said I have no idea what "hardware and software firewalls" was ePay.info talking about. Firewalls aren't really helpful with DDoSes. And "Cloudflare can't be enough always, they can get past it, having dedicated firewall is necessary" doesn't make sense either. To get past CloudFlare either the attack must be BIG (and 10 Gbps is pretty average, not BIG). They probably screwed up their domain configuration. For example epay.info domain is protected by CloudFlare, but it's MX domain isn't... If there was a DDoS in the first place of course. But personally I don't see anything that would suggest there wasn't one.
So,it is equal chance that the Does not happen or was happen on epay! this is correct.