I've not yet seen any clear, convincing reporting of why anyone would believe that the theater-threat comes from the same person/persons who compromised Sony's

I've not yet seen any clear, convincing reporting of why anyone would believe that the theater-threat comes from the same person/persons who compromised Sony's servers/network. The NYT mentioned an email sent to multiple media outlets – but did that email somehow prove inside knowledge of the hacks? Perhaps, by revealing fresh info or using a cryptographic signature associated with earlier releases or messages left behind on Sony's machine's? If so, no reports have said so. Another site mentioned a Pastebin source for the threat, which was accompanied with links to other Sony emails. But were those new, unique emails that could have only come from the hacker(s)? And which was the first threat source – an email or a Pastebin? These are basic questions of apparent provenance that should be answered in any coverage of internet-delivered threats.