You're right that you can end up with a suspect list instead of a direct answer, but it shouldn't be hard to narrow it down from there, especially in a case like this where most people wouldn't have access to privileged info about unaired shows to start with. It also helps if you have more than one IP address to start with. You can end up with multiple suspect lists, but only one or two people who show up on all of them.