The paper explicitly claims that it doesn't identify users, merely links posts to IP addresses which belong to autonomous systems that are owned by universities or other elite institutions.
Good points however some universities at least in the US that I've bothered to poke around at give clients public ip addresses. It blows my mind, it's unsafe and wasteful but they do it. This may have changed or been unique to the ones I found looking around for open RDP not believing how dumb people were to expose it to the Internet