You will never be able to justify the collateral intrusion that getting all the connections to a single cell site would represent.

If you don't know who you're looking for then it isn't actually that much help in any case.

Assuming you know that the suspect phone will have pinged a given cell site, then you still have to work out which phone it was. Assuming that they're not daft enough to use anything other than an unregistered PAYG sim, then you're left hoping that the IMEI of their handset has come to police attention.

If you had the resources, you could get the top-up data for all the unregistered sims attached to that cell site and hope there's CCTV at a given newsagent or that they've used their own bank account to top up online.

That's just it. There's already a frontend for the police to use that gives them access to all the data for a single phone number, sans warrant. Does that same frontend allow them to perform arbitrary queries across the entire dataset?. If not, then pursuing this lead would involve filling out forms and writing letters to telcos, possibly even obtaining warrants (unlike the usual process), and they probably wouldn't bother.

Incidentally, the ability to perform unrestricted arbitrary queries without a warrant across the entire phone-location dataset is a fairly horrifying amount of power for the police to have. But I suppose legally that ship has sailed with RIPA, and now it's just a question of the fine details of the implementation.