You'd be surprised, after 10+ years worth of accounts and online presence it's easy to trip up - reuse an account name from years earlier, use their real email to register for a domain, etc. Krebsonsecurity.com has a few articles where he tracks down an attacker's real identity - e.g. https://krebsonsecurity.com/2020/07/twitter-hacking-for-prof...