They could still subpoena relay operators for IP addresses, the rest is usually easy. It takes a single post to a compliant relay to permanently doxx your npub that way.