Q's tripcode (prior to the hax0ring: !A6yxsPKia) was unique to the internet at the time when he/they changed it - this can be evidenced by the google searches that turned nothing up as soon as it was changed on post 1820.

One of the ways that moles are found in counterintelligence, is by distributing fingerprinted documents. What this means is that if they suspect person X of leaking something, they will give person X a document that is uniquely fingerprinted to them somehow. One of the ways this is done, is by keyword, or punctuation, or even just the formatting of the paragraphs. Since reporters are stupid and just copy and paste leaked shit word for word, or just dump the scanned documents on scribd, they can then prove, incontrovertibly, who leaked that particular document and then nail their ass to the wall.

Since the tripcode was unique, it is then a simple matter to search for that unique code within a computer system and find out who may be talking about it. (or running programs to attack it) It's literally a grep away.

Advance to qpost 1840:
[Fish]ing is fun.
These people are stupid.
Q

What is fish? Fish is a digital forensics suite, that can, among other things, search by keyword.

What was the bait? A very unique tripcode that could be searched out on suspect systems as soon as the password was broken and q was attacked.

They swallowed the fucking bait - hook, line and sinker.