Binary blobs running on user boxes can collect direct, identifiable, evidence. Spying an IP address from afar that may or may not be proxied/NAT'd is flimsy circumstantial evidence at best.