I would assume they have evidence, maybe via a warrant to his ISP, that showed the transfer of files with hashes of known illegal content. They might have evidence content was transferred to a computer on an account in his name, but they most likely do not have evidence of his actual possession of illegal content.