They had the victim's device and logs from the messaging service. The issue was that the logs were attributed to the wrong user.