General Discussion

I know they caught him by looking at raw server mail log files and spotting his IP address.

I think a good question to ask was the timing of when he deleted his browser history. He knew that he had broken in to her account, and that this was unlawful. And Yahoo was aware of what was going on the day he did it, and probably located his IP address that day or not long after that. So, I think he probably knew that investigation was coming his way shortly after the hack.

If Yahoo and the FBI had already gone through prosecuting him and doing everything and he did this months later, then perhaps he could argue that he didn't think his actions then would get in the way of an investigation then, if he had perceived it had already been concluded then. I have to believe though that they probably went through his computer after he purged these records shortly after the hack, which is why they went after him.

I'm guessing they probably wanted to make sure that he hadn't hacked others' accounts too.