It could also be a coincidence, but a good enough clue to link two together.
(along with the match in the header)
Well, the person admitting when confronted was certainly enough evidence. Had we needed to we could've used the log data and work with the cops to subpoena the logs from Microsoft/Hotmail, but the person confessing saved us that trouble. AFAIK the issue was resolved internal to the company and no law enforcement was ever involved.