I'd say the most obvious is an old e-mail sent to her containing the username and password. Do we know for certain that the judge who issued the warrant was aware that the same username/password was repeatedly issued to different persons?