https://archive.org/details/COM_20120127_020000_The_Daily_Sh...
In this case, the subpoena probably looked something like "this email must have been sent by one of your guests, so give us the guest list and we'll cross check and find the guy".
Contrast with the geofence subpoena. "Hey maybe some small % of people carry a phone that might send its location to you, can we check if they did?" It's ludicrous.