This goes into the same direction as your last question.
Having an entity centric index helps again. If in addition to min(ts), which corresponds to "user first seen" you add a max(ts), which would be "user last seen", you can use a scripted metric to check whether max - min is above a threshold you define for "returning user".