Since Harvard's WiFi requires you to login with your HUID and password, it would be trivial to look at all the internet traffic from campus at the period before

Since Harvard's WiFi requires you to login with your HUID and password, it would be trivial to look at all the internet traffic from campus at the period before the threat and see who was using Tor, and investigate those specific connections, since Harvard logs every outbound TCP connection..