Interesting about the logins. In the age of data science, it's amazing what can be and is easily tracked in an app like a school portal. I don't know this specific software, but, generally you can see user activity based on login, so I don't think it'd be from a "remember me" type of deal...these were intentional logins. User actions and automated actions generally have different behavior signatures, which is how an IT professional or a firewall can discern the intent of the traffic.
Without knowing the full scope of what data is collected...I suspect that for the school to be confident that this was a login by LV, they use something called passive authentication. PA happens in the background without the user ever knowing, and generally consists of matching the device you used to sign up, or that is generally associated with your account, with the device currently attempting login. A lot of places use this tech - credit bureaus, Facebook, credit card companies, etc. In addition to the device fingerprint, there are other checks happening, such as IP trace (known bad actor IP ranges), among other information. It happens in seconds.
As an IT professional, what this situation tells me is that their credential provisioning/deprovisioning process is broken, considering JJ was removed from the school in September and it's now February, and her access was just cut. The access should have been cut upon their exit from the school, but generally, there are periodic access audits to avoid such a thing, especially when it comes to seeing sensitive information about children.
However...this is also a good thing for LE. Each login will have an IP (and a trove of other data) associated with it, even if the pair is smart enough to use a VPN service to hide their true location. In my security days, I used the VPN service IP range to track a ring of fraudsters...it gave me one way to narrow down my field from millions of accounts to thousands...and then in that batch, I found other things that all matched and eventually narrowed my field to around 100. One thing about people - they are creatures of habit and will do things the same way, even if they're trying not to. Something about their habits will come through. In the case of the fraudster ring, the accounts were all set up similarly..same style of name, email, passwords...zebras don't change their stripes.
I don't say any of this to scare anybody, but more to offer insight. LE knows a lot more than they're releasing. They had to have probable cause to get a warrant for electronics, and I suspect their probable cause is coming from data analysis.
All my own opinion, of course.