The author may have many sources for that identification; she says he "was known in hacker circles" by those names, which suggests there are many people who could (and possibly did) confirm the nyms to her.
It's background info confirmed by at least one and probably multiple sources, and journalists specifically don't want to or need to footnote their stories with multiple named sources like a research paper or legal brief.
If it's not shoddy journalism, then it's shoddy writing.