A very good question, and one the author doesn’t ask. I suspect via inferring from certain known facts, like unencrypted data provided by LEOs and IP addresses, who was talking to whom and when. Or they had a mole in their group.

Or they have a backdoor, which given how lovey-dovey Zuck has been with Trump, seems just as plausible as the other options.