When I worked for an ISP. I could call up connection logs from the terminal servers with two keystrokes. It had username, time connect, time disconnect, what kind of temination, IP addesss, Term server address (for tracing spoofed IPs), how many channles you used and what kind of account. Give us any of this info and a timestamp and we can see who you are. ISPs have to protect themselves too.