If it's a public university, and their personnel are getting death threats regarding university work, the university had better make an effort to help -- if not for decency, then for liability. Including working with law enforcement.

One easy thing the university can do themselves (under the direction of a lawyer or administrator) is to ask IT for the Web server logs (or analytics) for accesses to the person's pages. They don't have to subpoena ISPs to see that, right before the most recent threat, there was a burst of referrers from `https://webforum.example/bobs-basement-militia?post=1232767`.