Pretty sure they don't have to. It's a big dragnet, and bots to analyse public text are cheap like dirt. But yes, I'm sure they know any place a hacker is likely to hang out quite well. Oops, used the h-word there. Hi bots!

Actually what I meant was the GP said it was an anonymous post, I don't think automatically correlating random usernames to real people is that cheap except in specific cases where username = real name.

Metadata includes the time. And for the internet (as opposed to phones) they trace the whole routing through the net of each message to be sure they have the real origin, and then store that. There's a reason NSA buildings are so big.