Section 210 expands the type of information that a[n Internet service] provider must disclose to law enforcement to include, among other things, records of session times and duration; any temporarily assigned network address; and any means or source of payment. This heightened authority to use subpoenas (rather than court orders) for a broader (and more revealing) class of information is not limited to investigations of suspected terrorist activity.
At most they would've needed the logs from two ISPs: the one hosting the Web site and the one hosting his connection.
