Humm, it is always difficult to find out things like that as the perpitrators are clever enough to mask their IP address by using someone elses. Its a practice called spoofing. It happens with email too. From a UNIX (rather than Winslows) server it is possible to email or logon pretending to be somebody else, on an email you can figure this out (usually) by viewing the header of the mail (a bit at the top that is hidden). With IP (an address which is like your home address for the computer) it is more difficult. Other people can pretend to be you. This becomes more difficult to track as people who use offices hide behind a central IP address (esentially a block of flats with locked doors), if you dont know the NAT addresses behind the firewall you cannot know an individuals address within the block.
All round it is a difficult business.
I know this for two reasons...
1/ I work in IT.
2/ Someone pretending to be me was according to Dan bombarding the site in the denial of service attack. :(
I dont know if it is still going on...I hope not.
