probability

It all kinda depends on what's on his router. If it has logs, and they haven't been altered/cleared in a long time... it could show that bob with MAC address 01:23:45:67:89:ab (not owner's typical MAC) visited 2 days before the incident, then 10 min before the incident. Maybe then they can show it on neighbor's AP's. (war-driving) They could say it's more possible that a war driver sent that email. If they look, and the logs haven't been alted/cleared and only 1 machine has ever leased an IP, then they should focus on that dudes' pc. Need more evidence.

Just because you have an open AP doesn't give you automatic "it must have been my neighbors kids" license to hack all day.