I’ll try to reply to everyone at once.

He has two screen names, one that he hadn’t used in a while, call it ‘AAA’, and another that he used regularly, call it ‘BBB’.

He used BBB from a computer at a friend’s house on New Years Eve, and it’s possible that the password was saved, on that computer.

On Wednesday, he got the message, while logged in as BBB that he was logged in from 2 different IP addresses. He immediately changed his password. He later got session transcripts from some of his friends that showed threatening and nasty comments, made by the second person.

I told him to stop using BBB and alert his friends, via telephone that someone else was using his screenname.

On Thursday, while using BBB (ARGGGGH!), it happened again. I asked him what his new password was, and he had made it AAA. I was able to make him see the error of his ways. He changed the password yet again, and has started using AAA. He has kept BBB in his buddy list, as has his sister, and alerted his friends.

It happened again, on Friday, this time while using AAA. This was with a brand new password, vetted by me. This time the interloper signed off right away, but again, he has his friends watching, ready to save sessions as necessary.

At this point, I’m wondering if there’s a way to find out the IP address that an IM’er is coming from. We think we know who the troublemaker is, and this information would allow us to nail it down.