More so that they used the same Windows machine where they were signed in with their real personal Microsoft account as the machine they used for their illicit actions.

VPN only masks your source IP, not any of the other identifiers, of which we now know a new one.