Amtrak is just a one source, of many. Intelligence agencies not only get the information, but also get this information via different channels to have redundancy and to verify those copies against each other. Sources do not know about each other. That is basic rule in operations against the enemy. To begin with, most likely Amtrak serves have been hacked by NSA long time ago and they have the information directly. In addition to that they have insiders, on the payroll, to get the same data as well as interpretations on the data. Call it "customer" support. There is the last avenue, "constitutional", is to go and get subpoenas or other boring methods.
Such redundancy was needed to give impression that the public has "privacy". Spying was performed first and, later, when the case was built, "different" sources were shown. All for the appearance of "privacy". Greyhound buses, Urban transit, Amazon, Ebay, iTunes, Fedex, USPS, EZ pass,: everyone has a "file" recorded in relationship databases available for query.