only state actors can correlate an IP address to a physical address because they need to ask the ISP.

(I know I'm being annoying but) not necessarily only state actors, but if those state institution or the ISP are infiltrated or also have bad security that can also happen. Sounds redundant, but the difference is that the guy wouldn't need to be important enough to piss off the state, this can happen just by pissing off smaller neonazi orgs, and also gives the state itself the benefit of the doubt. Happened recently to one big communist figure in Brazil that a neonazi org threatened him with emails coming directly from government accounts.

The Zionist non-profit here could even be a red herring.