[colechristensen]

You ask the ISP who owns the IP who was using it at a specific time, when it turns out to be your former employee’s home, you ask for a search warrant to sieze her computers as evidence. Then you try to match logs on a device with logs on your servers, and additional evidence perhaps as well in order to establish beyond reasonable doubt that this woman did indeed do what is being accused.

[aaomidi]

Yes because ip spoofing doesn't happen.

[zaroth]

So your conspiracy theory is someone sent the message and spoofed Jone’s IP address in order to frame her? Give me a break.

In any case, the right response is to serve a warrant and check her devices to see if there’s substantiating evidence.

It wasn’t any random IP. It was her IP.