I don't really see the relevance. AFAIK they have an IP address which matches her, which a judge considered good enough reason to seize her equipment and double check.
An IP address retrieved from the Apache logs by the same sysadmins who put unhashed credentials online in a place where they could be indexed by Google?
They should have no easy way to match the IP the ISP assigned her.
They didn't take the router, just her phone and computer which won't show the public IP.