If it's a GRU machine, I find it highly likely that the NSA would at least be trying to monitor communications from it[1]. It's possible that they can't get an active tap on the GRU's internal network (at least on-going, and doing so might not immediately reveal the source if the documents are only transferred over the active VPN connection -- having network access doesn't necessarily imply access to endpoints), but can tap the upstream connection. Once the source has been identified as a particular connection/building, I can think of a number of ways it could then be narrowed to an individual:
* Agent embedded in the office - they might not know about the operation beforehand if it's well compartmentalised, but may be able to find out more now they have that initial information, or rule out enough people to narrow it down
* Breach the internal network, knowing that access will be short-lived and discovered, but for long enough to get the information you need
* A further slip-up that, e.g., includes a name or some other identifying piece of information (e.g. cookie to a non-HTTP site), or accessing GRU systems that the US have previously breached or are otherwise improperly secured from the same machine
* Forge the VPN set up so that the user connects to NSA-controlled servers -- doesn't seem out of the realm of the NAS's capabilities; or
* Work with Elite VPN (unlikely--they appear to be a Russian company) or breach their systems (I imagine their security is less than GRU's, especially if they have servers in France which would likely allow the NSA or their French counterparts to compel physical access) to gain access to the VPN traffic. Once you have that, insert a zero-day into the traffic to gain access to the GRU machine
* Use a QUANTUM-style attack to embed a zero-day into non-VPN requests made over that connection
It's unlikely that you could immediately go from IP address to GRU officer, but working from that IP address you certainly have options that could lead you to an individual. I think it's quite clear why NSA would not want to reveal which technique(s) they used, particularly as it could lead GRU's countermeasures to be specifically targeted against useful methods.
I'm also not particularly sure it matters all that much. It's quite possibly the work of a team (even if the actual postings come from an individual) and will at least (presumably) have command authorisation. The article notes "[s]ometime after its hasty launch, the Guccifer persona was handed off to a more experienced GRU officer". Attributing it to an individual, rather than just the GRU, doesn't seem to make much difference.
[1] I find it possible that traffic analysis was used to uncover this -- find that Guccifer 2.0 is posting via Elite VPN, then correlate traffic in to Elite with possible sources. I'm surprised that GRU wouldn't use a machine that is forced to connect to a VPN for this, particularly if the machine's public IP points back to GRU/Russia, so it being something more that "agent forgot to enable VPN" would not be shocking.
Edit: fix list formatting