My guess is he simply did tons of research starting with IP. IP you can get info like state or county. Maybe she gave her real name and he was able to use that name and county to find a bunch of matching social media profiles. From there if it's not set to private, maybe he just read a bunch of status posts. See what photos she's in/tagged in. etc. Unless he's like some next level 1337 leet haker who cracked her social media passwords.