So was the user(s) of the account leaking information illegally or not? May not have any bearing on this, but it seems everyone is glossing over that question for some reason. It's either a dissenter of which there are many, or someone breaking the law and we should probably establish which.
If you're so concerned that the Trump administration is actually doing the right thing here and they are being inappropriately maligned, you can certainly go look at the legal request and check for yourself on what grounds it was made. You don't need to wildly cast about searching for/inventing some reason the government is right -- they are supposed to do that themselves and write it up in a public legal document, it's called the rule of law.
If they had any such information logically they would have presented it to a court of law. The inference that we the citizenry and indeed that a court of law ought to draw is that no such evidence exists.
Certainly the governments lawyers aren't morons. Had they had such an easy route to take they wouldn't be attempting to misuse the law this way.
That still doesn't explain how whether or not the user was illegally leaking documents is relevant. The request has nothing to do with that. You can read it yourself.