Seems similar to how Jeremy Hammond was caught: they suspected that he was a particular IRC user, and correlated his login/logout times with actual comings and goings from his residence.