It's entirely possible the LEO was masking his IP in some way; he didn't give any details. There are many other ways of flagging fraudulent (or anti-fraudulent...) accounts and transactions.
Could be blockchain analysis. Block accounts that receive bitcoin from known seized funds, like a Silk Road wallet. Basically just the opposite of tactics companies like Coinbase employ.
Thats what my bet is on. LE agencies have contractors that procure bulk quantities of prepaid phones, prepaid credit cards, etc.. for undercover investigations. I suppose its possible they traced the BTC from a funded wallet they knew was government related.
If they had prepaid credit cards, why wouldn't they just buy some Bitcoin from Coinbase with it? That wouldn't be traced back to them (unless another law enforcement agency was investigating... or if the fraudsters compromised Coinbase).
I feel like they'd at least be smart enough to use a tumbler if they were pulling it from known seized funds. They could also just give the investigator a $300 prepaid debit card card and have him buy some BTC on Coinbase.