OK. They assumed they scanned a 2^58 range because they found 1024 addresses that start with 48 zeros. But what did they scan for? An address that starts with 48 zeros, or address of Puzzle 67?
LOL, I already responded to your "key by key" argument, and now you want to change the topic to reach a point that validates you. You see that I'm right and you're just a troll. Vanity starting with 1111xxxxxx, I don't see where you're going with this—well, I do see, I suppose to a point where it seems like you're right by saying that 1111xxxx isn't the same as 1BY8GQb because you're considering the bits and blah blah. Anyway, you're just paving ways to justify yourself. Man, I'm not a fool, I know what you're doing, but go ahead.
Regardless, assuming that a key isn't in a subrange just because you find 1024 matches is also "probability".Although the difference with my method is that if something fails or I miss the target, I can always readjust the DB without losing progress. On the other hand, if they casually omit the target, there will be no way to know in which subrange it was omitted, losing the progress.
He did not do a VanitySearch via an address, the way JLPs does a vanity search. He scanned a range and only saved H160s that met his criteria as a PoW key; which in his case, he used the leading 48 bits; 2^58-2^48 = 2^10 = 1,024. This saves time versus breaking it down to a vanity/any address. But he did not skip around after x keys were found. He still searched the entire subrange and kept the PoW keys as proof that the search had been done (think of proof to himself (that he actually scanned the range) and his investors). So in a sense, he was using probabilities as proof, but not to adjust his search pattern; he still scanned 100% of the subranges, even if he found 1,028 matching H160s before the subrange had been 100% completely scanned.