If the offending IP was a tor exit node, and dude was using tor at home during the same time period, that would almost certainly be appropriately admitted as circumstantial evidence.

He would of course be permitted to make an argument as to why that circumstantial evidence is weak and should not be given any weight.