79 arrests out of 1400 suspects

"Most of the suspects identified in Operation Stream were matched against records in Europol’s databases, proving that most offenders engaged in child sexual exploitation are repeat offenders and are not unknown to law enforcement authorities." That suggests that they put known suspects under computer surveillance, and matched their tor-connected times and download volume to statistics on the server, which I presume they continued operating after it was located and taken over. They may have used other social engineering techniques to unmask users on the server.