That's how it generally happens from what I understand. A local or isolated investigation is started and during the process they may uncover a reasonably high-level source of the product. Should they be lucky enough to get a warrant to scan an email server that has plaintext business contents, they might come across a trove of tracking numbers. From there the three letter agency will disseminate tips and intel to more local police forces and field offices and innumerable people start getting love letters, visits, surveillance.

I also recall hearing that the USPS tracking info page is quite complex under the hood and logs a lot of your device/connection information when you enter a tracking number. No idea how true this is, but it wouldn't surprise me at all and I hope people behave as if it is.

Agreed about the wasted 20's on the internet. No doubt I could have better spent my time. But there was some incredible and wild stuff going on out in the wires.