"He was apparently really careful about connecting to the server. "

That is not, by any measure, careful. That's awful OPSEC, and what got him in the end. He thought Tor to be inconveniently "slow", and used VPN instead.