The Trigger in the Haystack: Extracting and Reconstructing LLM Backdoor Triggers