Usually you trap them into clicking a link you control. Alternatively you hijack their account somehow and find out where they logged in from. That the address

Usually you trap them into clicking a link you control. Alternatively you hijack their account somehow and find out where they logged in from. That the address in Washington is a TOR node or any other kind of proxy is of course a very real possibility.