this is exactly right. they were already watching his account in the CEX and saw the monero arrive there.

the moral is

"don't think that sending your surveiled Bitcoin through a swap to your exchange account makes them clean"