The ssh public key might also be interesting, given the opsec failures, they might have used it for other accounts / at other providers