The interesting thing about the situation I read about, is that the provider was (at the time) high-profile and on tour. It seems to be a simple case of LE finding their references (which no doubt, said something like "yes, I've seen client John Doe") which makes it seem that this was all they needed to secure a conviction. Which tells us two things: 1) cops DO subpoena emails and their contents and 2) the importance of using a secure, fake and untraceable email address is something that should never be overlooked.