How does he know that Glitter Draw Free was the culprit?
It's well known that APNS tokens are not unique on a per-app basis, even though the documentation says they might be. [0]
The theory that the leak didn't originate with the FBI is totally plausible, but I don't understand the connection with Glitter Draw Free, and I suspect the email's author doesn't realize that APNS tokens are not unique.
The fact that they had the details about the app pushing data through apns.spankapps.com means they probably sniffed the traffic when launching each of the apps on his phone, and saw that the device token that app was sending up was the same as the one from the leaked data. Pure conjecture, but definitely plausible.
Sure, but he can't know that that particular app was the culprit with only that information because every app which has ever been installed on his device (barring a complete re-installation without restoration from backup) will send the exact same token.
The only way to blame one particular app would be if that app were the only app ever installed on a device whose identifier appears in the leak.
It's well known that APNS tokens are not unique on a per-app basis, even though the documentation says they might be. [0]
The theory that the leak didn't originate with the FBI is totally plausible, but I don't understand the connection with Glitter Draw Free, and I suspect the email's author doesn't realize that APNS tokens are not unique.
0: http://stackoverflow.com/questions/2338267/is-the-apn-device...