I highly doubt that they paid for the Flash.
Also, the addy is for a Hotmail account. Seriously, how hard is it to make a new, fake e-mail address for a singular purpose? I know that a lot of us have and admitted that we have spam e-mail addresses.
Also, the only way they could really track the hacker is through his e-mail account (if they could get MS to cooperate) or through the actual hacking. Also, that's only if he has a static IP also, and aren't there methods to relay the IP?
For instance, hack into another person's computer and use that as your "base" and hack from there? I don't know too much about hacking but this is just what I'm thinking.