The bad guy will have gone through many, many steps to conceal his identity, through pirated or hacked accounts.
This guy didn't participate in the misappropriation, and probably didn't conspire with anybody to misappropriate it. Once it's posted online, it's just not secret anymore. At some point it becomes public information.
If you are a determined bad guy, you will find relatively easy ways to avoid detection. The good news is that most bad guys are not clever and not determined.