Statistics for MAC Constructions: Security Bounds and Distinguishing Attacks