The person/people who swatted MTG used some sort of abuse hotline website. No phone needed and they used a VPN to prevent tracing.
Website access through a VPN is still traceable.
It is time-consuming and gets expensive. You might start out with a list of 10000 subscribers to the VPN and a couple of trainees doing the initial screening. With a few basic search tools and a dweeb who is good at python scripting, you can cut down that list to 150 people fairly quickly.
It goes even faster if the Website host provider and the VPN service are cooperating with your department. Most of them are going to do so. Some of them will require nothing more than a phone call to the right contact.
Or you can pay a commercial service to generate a "specialized marketing prospect list using custom parameters". No warrants required at all. Just a current business account. You do need a skilled analyst who knows how to define the selection parameters. It is an art of wizardry. In an age of mass-market data collection, it can be shockingly effective.
Why bother to create a police surveillance state when private corporations will do all the work for you?
Ultimately you end up with a list of a dozen suspects for whom you will need to arrange field interviews. You will probably need warrants for that. You send a pair of agents to each candidate. The one who flinches or tries to run is assumed to be your perpetrator. Put them under intense scrutiny. You will find something to justify charges and maybe even an arrest.
Chalk up another success. Make sure there is a press release. Commendations for all and a promotion for the supervisor.
But this much effort is normally expended only in cases where the victim is an approved somebody of importance to the authorities. Ordinary citizens, or opponents of the current régime are unlikely to receive this level of attention.