I assumed that this meant the attackers logged into their own social network accounts while they were "inside" (i.e. using) compromised machines in the target locations.
Yea, some people suggested that in the forums. It doesn't end up being the full 768 (which is not the end of the world) but you also lose the extra HDD and bandwidth so you're actually paying more at that point.