A friend and I uncovered this a while ago, but I don't know if it's been made known to folks on this forum...
We all know by now that many of the alleged hijackers made no efforts to conceal their identities or activities as they moved about the country before 9/11, even though a number of them were already on terrorist watch lists, or were being closely monitored by programs like Able Danger. This point is really hammered home by a document*1 from the Zacharias Moussaoui trial where there is a listing of real name usages by various hijackers. Among these, which I find quite hilarious, is the fact that Atta's e-mail address was mohamedatta@hotmail.com. Ziad Jarrah likewise used his real name, ziadjarrah@ab.com. This latter e-mail address raises further curious questions: ab.com is the domain for Rockwell Automation, a major U.S. defense contractor. web.archive.org*2 confirms that ab.com has been Rockwell Automation's web domain since at least 1996. You can't just sign up for an address at ab.com like you can with hotmail or yahoo... they only give them out to employees.
*1 http://www.vaed.uscourts.gov/notablecases/moussaoui/exhibits/prosecution/OG00013.pdf
*2 http://web.archive.org/web/*/http://ab.com