It's possible the events went like this:
1) MS get suspicious and investigate, (legally) find things which point to the suspect.
2) They confront the suspect who confesses.
3) They take it to the authorities who as part of their investigation get court orders to access his hotmail accounts.
But based on what is here there is nothing that says MS did anything illegal. That's not to say they didn't, just that that's not what these posts say.
The blogger approached MS, so once they determined the code was authentic they could have easily got the FBI involved who then requested the information from the blogger's account.
But it doesn't read that way, it suggests that MS looked into it because it just says "investigators" and it's up to the reader to surmise what that means. My first thought it meant MS did the looking into the account mainly because there's no mention of a timeline of the actions taken. If it said something like "after MS authenticated the code the FBI was contacted who then requested a warrant to search through the blogger's account" then it would far more clear as to what was going on.
Makes me wonder if anyone bothered to ask the blogger if he would cooperate, as he did approach MS first, or if they just start looking through the person's account?
Later in the article they mention investigators again after the mention of criminal charges and then you can likely assume they mean criminal investigators.
- "prompting corporate investigators to dredge the Hotmail account the blogger"
- "While searching the blogger’s account, Microsoft investigators found an email"
Obviously the guy was massively stupid using an e-mail service run by the people he was screwing over but it'll be interesting to see how this plays out (whether his employment contract covers it, whether that's legal and so on).
"Select id from attachments where introspective_function(part) contains 'LPCSTR'" as a scheduled task?