Yep, it lists all 3 instances in the Admin Log... Here is what I see:
You can see that his most frequently used IP is what he was on when restored his permissions and logged into the admin panel. Well, I guess you can't see that, but the 1st IP is the one he has posted from most frequently. However, there is a second IP that he has never
I should also mention that he just changed his password...