Law enforcement could probably just ask cloudflare for the exact IP address that retrieved the attachment.
Only if they're from a friendly country. If the reason a user needs anonymity is geopolitical, that isn't a guarantee.
Anyone can do this are per the TFM, which is an excellent read.
do you think law enforcement in Iran will get an answer from cloudflare?
Only if they're from a friendly country. If the reason a user needs anonymity is geopolitical, that isn't a guarantee.