It article says “domestic flights [plural], and at other locations that police said were linked to the man’s previous employment”, so it’s possible they checked

It article says “domestic flights [plural], and at other locations that police said were linked to the man’s previous employment”, so it’s possible they checked passengers in common between two or more flights that had reports of bad portals as well as other locations that pointed to this guy.