Another find on DataLounge: The same poster (who may or may not be Beavis Butthead) who posted the earlier creepy messages, including the link to the image of the package, has created a thread there asking whether phone apps are traceable.
http://www.datalounge.com/cgi-bin/iowa/ajax.html#page:showThread,11653487,1
http://www.datalounge.com/cgi-bin/iowa/ajax.html#page:showThread,11653487,1