Since it's a guessing game regarding what the police might have, here are my two cents...
It seems clear to me that the police are sitting on a lot of information collected from the computers they could get their hands on – from the school, the public library etc. – back when Andrew disappeared. Since those were shared computers, you can’t possibly rule out if this or that action could be attributed to Andrew until you look at every lead.
This search can be a mess because you can’t know what could be meaningful and what’s totally unrelated to the case. If you gather all the online activity of 10 computers in the public library for a week, that’s a challenge already. Back to a month, even more so. You can’t know if Andrew even used one of those computers, and if he did, you can’t know if he always used computer 1, or had used computer 3, 6 and 8 also. You can’t rule out any searches made regarding bus schedules leaving King’s Cross station or records of communications using random usernames (with no need to provide a personal email or connect to an account to log in).
It is possible that some of those interactions stood out. Like someone logging into a forum that could relate to Andrew’s interests and interacting constantly with some other user. You might be able to track this person’s username back to them years ago. But you don’t know if this person was even talking to Andrew based on what you got. This person can’t even be named a person of interest, let alone a suspect. But you keep them there. If, 16 years later, this person is caught by another crime of similar nature, you might have something to go on...
It could also be that some corroborating evidence comes up. It's often said that the police have no CCTV footage apart from Andrew leaving King's Cross. That's not necessarily true. They could have collected images still available from some public streets that day or the following days. It's just not possible to identify Andrew for certainty, because lots of kids around his age followed a similar emo-influenced style.
That's very arduous work: imagine you have access to one camera in Block A, and another camera in Block C - there's no footage in Block B. You see a boy walking on Block A and reappearing a minute later on Block C. If you see a boy walking on Block A and not showing up on Block C, you don't know if this boy was abducted while walking over Block B, if he entered into someone's house, if a car driving by on Block C could have taken him against his will, if the entered the car voluntarily etc etc. As years go by, such a thing might be impossible to verify.
But that's something you can throw in the wall to see if it will stick if the person that could become a suspect (the one with the username found in the computer) was registered to be living in Block B around that time. You can't know if it was even Andrew who used the computer or was caught on the footage, but that's at least something to go on.
Then you move on to talk to people who knew the suspects around that time, and it's easy to get confused minds to mention something like 'I remember once, when he was drunk, he said something about this boy Andrew...' - we see this all the time. Those are the sort of protocols the police must follow before going ahead - they need to build a probable cause theory, even if a frail one.
Since the two men here were discharged, the 'kidnapping and sex trafficking' theory was just what the police could conjure up to get them under arrest and allowed to take personal devices and so on. I don't spend much time thinking about these particular suspects, but this arrest even happening really confirms they have a lot to still make sense of. I doubt those were new findings.
