[yaongi]

The server image was made July 23, his fake IDs were intercepted July 10.

I guess the investigation stemming from the IDs was probably where it started to come together.