Bellingcat are a parallel construction laundering operation.
This is my thought too.
Whenever I see one of these "crazy ways criminals give themselves away" stories I'm now thinking I'm probably looking at a parallel construction.
During the Floyd protests a woman was recorded on camera in Chicago destroying a police car. A week or so later the police arrested her and claimed an improbable series of gumshoeing around the tee-shirt she had on, figuring out where it was purchased and subpoena sales records then doing a lot of cross referencing.
Far more plausible to me is they pulled cellphone location data.