Know your threat level and at least always use a VPN you can trust. In this case a simple VPN with a good provider would complicate it so much to get the real identities (provided they did not use real emails) that it would have been enough. The higher your threat level, the more sophisticated tools you will need (Tor, Tails, etc...)