They could have just literally read the emails the account had sent.Or looked at who the recipients were.

Or even have checked how busy the account was.

Or check their received legal mail.