Evernote client syncs locally. They performed forensics on the filesytem, and the note was more than likely cached locally on disk.

Weapons-grade stupid on VanderZanden's part.