If he used different wallets to buy different coins then the correlation might not have been noticed. Buying coins right before they're listed on Coinbase is still suspicious but it would have been less suspicious at least.