I would think that when operating any type of illegal online enterprise, you should always operate under the assumption that everyone you're talking to is a government agent. So you should never reveal anything about yourself. The government is obviously making many undercover purchases.

Traffic analysis is a risk, but questionable. If it was used in this case, I want to follow this case closely to see more details. Because I haven't heard of a case of the government using traffic analysis to identify users except extremely basic stuff such as "we saw him walk into his house, then saw some Tor traffic, then saw a post appear on the forums".