Case#1: Continue...
Netflow shown 15% extra traffic from a single subnet
traceroute -g shown the traffic coming to us
Install a static route of 212.x.x.x pointing to this router and traceroute stopped at ISP1
Install the route in BGP, traceroute shown it coming back to us
Thus this router of ISP3 had to rewrite the eBGP nexthop base on the AS numbers
This could not be misconfiguration or a simple pointing default. Also this was not just used towards iMCI.