Did it really take them 2 years to obtain the IP address and go through the Panera router logs? The Seattle Times article says "the investigation required detailed computer forensics to bring charges." I know a few things about computers/networks from working at an ISP and I feel like it shouldn't take the FBI that long. Maybe I'm wrong though.
That's because traffic at ISPs can be traced back to customers. Public WIFI is largely anonymous.
But in this case, the guy also wasn't supposed to be on the internet in the first place, so he wouldn't have had a home connection or phone plan that they could cross reference with for access with the same devices. CC transaction probably helped a lot, and from that I guess they checked more recent logs and security footage to check his behavior, allowing to link the devices to him.