Your assuming he's loging in to the account he's stealing and not selling them or given them away. Your also assuming he's loging in from his home computer and not from a library/school/internet cafe or anything else that has computers and internet. well its going to be a lil bit more complicated than that assuming that they are smart.there prolly using proxies to logg in and out of tha site there using. sadly i do know how there doing it and yes there going to be a lil harder to catch than what it appears ,because there are more than 1 way to hide ip addresses and taking that there stealing passwords there using keyloggers with a snd back folder. no im not part of what there doing but i would think i might help to tell u how they might be doing it. jus gotta wait for 1 of them to slip up. so a tip go to a friends house or where ever there is a nice stable comp, and change ur stuff there becuase if u do it with an infected comp ur going to jus end up giving to it to them anyhow. remember run virus scanns shell kit scanns any scann u can really get ur hands on.expecially key logger scanns. hope that helps
