It's also a good demonstration how probable cause is supposed to work.
In this case, the subpoena probably looked something like "this email must have been sent by one of your guests, so give us the guest list and we'll cross check and find the guy".
Contrast with the geofence subpoena. "Hey maybe some small % of people carry a phone that might send its location to you, can we check if they did?" It's ludicrous.
> give us the guest list and we'll cross check and find the guy
An entire guest list is still a broader fishing expedition than should normally be permitted. Warrants should be much more targeted than that. (Of course, many companies seem happy to give overly broad information without even requiring a warrant...)
A guest list on a single day seems pretty fine grained if you looking for someone who was there on that day.
Im not sure how they would get much more fine grained than that without already knowing the answer ahead of time.