> it seems reasonable to speculate that all four files may have been uploaded by the same person, who forgot to mask his or her IP address until after uploading the first sample.

Or turned it off after the first sample. Or switches proxies randomly. It's good they brought up that the IP can be masked, but they could go one step further...