That's what I suspect, but it also seems odd. He's in a jurisdiction I have almost no experience with, but if the 50k count is from computers used to launch the DDoS, the evidence for the crime would revolve around unauthorized access to those computers, which would be difficult to prove. I've never actually tried it, but I've known people who have launch hundreds or even thousands of EC2 instances for complex number crunching they were doing, which could equally be used for a DDoS.

Most DDoS attacks I've seen torn apart are typically sending out a command to a series of previously compromised computers running malware on them to launch an attack at a specific server. I'm not a lawyer, but I would except the prosecution to then have to prove each of those computers were unauthorized access if it is one count per computer launching the attack.

If, on the other hand, this was something like Slowloris, and the count is due to individual attacks that landed, it makes it much easier to prosecute, at least from my understanding of how most of these laws are set up.