They can. They just need to ask the ISPs who's using VPN and correlate timing of X postages from known accounts. The best way would be to use public WiFi, in a new device, with a new VPN provider, and never turn the device on anywhere near a usual spot, like home or work. Otherwise they can get fucked pretty easily.