But Google will usually provide logs/IP addresses (not content) to police without a warrant, which can be used to start tracking down the culprit. It isn't clear from the report if the Police got a warrant or even made a request to ProtonMail.
Most do not just sign in to a compromised account and send and email from their laptop... It usually involves some level of obscurity. Im sure if they want to find out bad enough they will- but I would be surprised if this was sent by someone just sitting there.