It seems that they didn't need that mistake if they were checking connections to the VPN from KPN users. They could do a cross reference by checking his connec

It seems that they didn't need that mistake if they were checking connections to the VPN from KPN users. They could do a cross reference by checking his connections to the outside and then times when the hacker was "attacking". They could also drop his internet connection for a bit to see if the hacker gets disconnected. And looking at how it was portrayed, it's doubtful his PC was "clean", especially if they catch him in the act.