Essentially it's a defense in depth game. You can sever links between cover identities and real identities, but you can't erase real identities with history as easily. Pierce the obsfuscated link, browse through someone's normal digital life.
Starts to make plastic surgery look downright cheap.
Information leaks easily. Which is the reason you shouldn't believe the vast majority of "conspiracy" theories. Not even a little bit.
In fact, it very much reads as a classical parallel construction [1], e.g. some secret service identified the suspect through their work (anything from double agents to court-ordered wiretapping to illegal wiretapping) and back-fed details to some independent organization to create a train-of-thought from it and publish it. Especially since the public group photo is marked "[we] do not claim" and the truly exposing details come from secret databases from secret "sources". That is not public or verifiable information.
We had things like that here (here being a former eastern-bloc non-USSR country, where people are extra cautious of manipulations because being spoon fed with propaganda for 40 years) exposed fairly recently trough leaked wiretapping files. It was in all combinations. A journalist begging secret operatives to give her anything saying she would publish that immediately. Operatives feeding true information to unwitting journalists. And so on...
Could be they knew what they had to find... Anyway, they have some great sources for an open source analysis joint! ;-)
Or, more likely, you are simply looking at the result of extremely tedious trial & error, with the failed lines of investigation omitted from the final writeup.