Agreed, this would be a really weird way for a state threat actor to reveal an otherwise pretty sensitive capability. I assume there’s something on the account which clearly links him to it and someone he knows recently remembered they know his old account name.