Poor opsec there to be honest; I think they handed over the recovery email address he provided when he registered which was some gmail or something address which easily gave away his identity.

As far as I know they were not able to access any of the mail in his account.