Captain
Unitard Obvious strikes again...
Thinking out loud about the camera Exif
DateTime 2009:08:03 00:31:55. Ignoring the hours (probably still set to bloggers home time zone), lets assume the minutes are probably accurate.
So if the ferry arrived in Tallinn at 10AM (local time), taking into account the time to clear terminal/customs/etc, finding a cab, and going to the first clue location Pikk Street door, a time of
10:32 at the castle/tower (second) cluebox is unreasonable. So that leaves
11:32 and 12:32 and so on and so forth. Conservatively speaking, they could have been at the castle/tower cluebox at
11:32am.
Primefun, who was following them, could narrow down the actual times.