The article describes how they immediately went to look for an unsigned 32-bit millisecond counter when they noticed it was happening around 50 days since last reboot, because they already knew that association you describe.

Interesting writeup. Fun little story about the detective work involved.