They probably used university computers, netcafe or public library computers and other user names- so easy to do and impossible to trace.
Did they check to see if they had library cards/student cards?
But university usually has cctv images of the computer users by date and their student sign-in handle.
Your post just reminded me of something else on the little psyho’s twitter account. It was sometime in the past year or so that he tweeted “Lost my Macintosh.” Wouldn’t that be convienent?