My assumption was that it would first detect when it was written using stylometry, and the change in style over time, and could use that, in addition to other l

My assumption was that it would first detect when it was written using stylometry, and the change in style over time, and could use that, in addition to other location tracking data in XKEYSCORE to figure out where the target was at that time. That might be giving them a bit too much credit. They could just be using some other simple heuristics to guess at location data. Hard to tell. XKEYSCORE is/was basically the NSA's Google, and in theory contains nearly all of the data ever collected from the various collection points all over the internet.