I made it clear that it was conjecture on my part. Pulling the IP from server logs was the most likely reason they got the warrant. Turns out that was indeed the case.