I'd expect that there would be some some central database of these machines that track their incoming and outgoing money that all the casinos feed their data into. It would seem crazy that this type of activity would go undetected to the tune of several hundred thousand. Even if payouts were tracked locally, it should have been a huge red flag. Unless the tracking that is sent over (or compared locally against baselines) is based off of in-play data and the amount exploited in the bug was never properly reported.