The most interesting thing to me is that they were uncovered because one bragged about it to his friend, who likely turned him in (or, since it was over Xbox Live, maybe it got caught in a filter or something). That's the #1 rule of criminal OPSec, don't tell anyone about your crimes.
The message for the general privacy community is similar, you're only as safe as your weakest link. For example, nobody cares if your email is self-hosted at an anonymous VPN and triple encrypted or whatever if you send plaintext emails to your friends and family on less secure email services.