He was caught by not using TOR to access the server to admin it, he used pretty straightforward ssh and vpns, which are a lot easier to track. They had a good suspicion that he was DPR from looking around at forum postings and the like, and the server was just the final dot that was connected.