Originally Posted by
sbm12
Beyond the headers we actually had firewall logs of the user in question accessing the hotmail.com website with timestamps that matched the header data. It was a pretty easy connection to put together.
It could also be a coincidence, but a good enough clue to link two together.
(along with the match in the header)