Heck it could be packet responses from someone inside the network running a global port scan of some kind - this would account for the traffic at the same time from all countries, and the boosted responses from China etc. He never said anything about outgoing traffic, so his graph showing only half ths story can't determine anything...