Even if he always used TOR/anonymous IPs, when accessing his @gmx.com account, with the number of sign-in's he had, it must be an absolute certainty, that he want through rogue exit nodes or some other de-anonymization methods we are not aware of, but deployed by gov. agencies.