Admittedly from the article: "used two separate anonymity tools to cover his tracks — the routing service Tor, which covered his web traffic, and the temporary mail service Guerrilla Mail, which offered a one-time email"

Then they noticed that "that the originating IP address would have been revealed in the email header, which would have indicated Tor usage"

And from there "agents checked to see if anyone had accessed Tor through the local wireless networks. That led them to <culprit>, who promptly confessed."

Doesn't sound like they even had to engage with Tor infrastructure or Guerrilla Mail backends, just 'hmmm did a student use Tor, oh some did, let's check them out in full FBI livery' which freaked the kid out and he confessed.

It's easy to check if an IP is a Tor exit node, but unless you happen to also have egress logs it's still a thornier problem to de-anonymize without heavy resources.