The issued subpoena requires X to share information sufficient to identify the person behind the account. This includes names, addresses, telephone numbers, email addresses, account numbers, IP addresses, and any other contact or billing records held by the platform. Taking TF's reporting at face value, would twitter be able to sufficiently identify a user? Does Twitter have the address, real names, etc. of its users…
You sue the social media to get the IP at time, then sue ISP with the reference to that suit to get IRL identity from IP + time, then sue the person using that IRL identity. Some parts of this has been simplified because courts having to process 3 lawsuits to move just couple grands for just a "@username I murder you this particular way and time" is ridiculous.
What if the accused used Tor or foreign VPN? I guess the matter goes to local FBI equivalent?