The result of the last meso exploit (RIP lMira)

The three transactions should occur within a pretty small time frame. If all trades were logged and timestamped, the log would look something like-
12:00- 10b received for arrows
12:02- 10b received for arrows
12:05- 10b received for quality endgame weapon
(approximately, of course. I don't know when the trades occured or exactly how long it takes to grab another 10b to trade)

But probably what happened with Nexon is that the first two trades were flagged as suspicious, while the third one doesn't show up because it seems legit. And that's where it takes some time to look up a character's log and browse everything and compare it to their story, rather than perhaps a basic log that only shows what's flagged as possible exploiting. Though, who knows exactly what Nexon does and doesn't do in terms of logging, especially when you consider the fact that if you logged EVERYTHING a character ever did, you'd have waaaaaay too much useless data. But really, every billion meso trade should probably put a timestamped entry on the log to help keep track of people paying in pieces.

Of course we can only speculate on how all of this is conducted on Nexon's end.
But what you depicted was an analysis that would require logic and context. At this point do you really expect them to be capable of either?
Plus I think I'd hazard a guess that this is a bit more like how the stream of transactions went:

12:00- 10b received for arrows
12:02- 10b received for arrows
12:05- 10b received for arrows
12:07- 0 mesos received for quality endgame weapon

and if things are so selectively logged as you suggest they be, then even that wouldn't look innocent.