Easy. Someone used and unprotected computer as an echo point, so the wanted data was first downloaded there, then sent onward....meaning that a simple IP trace like many law enforcement agencies do would lead to the the first computer. And anything you download to your hard drives is still there; deleting it doesn't remove it, just the access reference. Even overwriting it doesn't mean it can't be reconstructed with the correct software. And very few people are capable of NSA level data wiping. Sounds like they got very lucky and the cops found the bot that the hacker used to make the system a zombie as well....