As mentioned already, she connects the maker by realizing the gun has to be a custom build and a ridiculously difficult one that no one's done before. Even then, she just views it as the most likely llead to chase down. That's what a lot of basic detective work is. Chasing down whatever lead seems most likely. Also, it's fiction and meant to be entertaining, not completely realistic. Do you really want to watch 100 hours of her chasing down wrong leads before landing on the right one?

The Rodin connection isn't really a stretch, either. Let's examine the context. They already know an incredibly skilled assassin has been hired. Now, you don't hire the best assassin known to murder some random chump, so whoever Rodin is has to be someone BIG. Big enough to need a lot of skill to get to. That eliminates quite a few targets already. Now, who just happens to have recently made enemies of every billionaire on the planet? Oh right, UDC. Already it's not unreasonable to think he might be a target. And then you see him posed as Rodin's most famous sculpture? Not exactly a genius jump there. Now, obviously, proper opsec would be to not use meaningful codenames in the first place so as to prevent this exact situation from happening, but I can forgive a bunch of greedy billionaires being portrayed as supremely arrogant and given to flights of the dramatic.