Here's a possibility: On his blog he has a field to enter in your email address to subscribe to posts. If he's recording IP addresses there's a good chance his friend (not the son) would have put in his email to follow. Once he got the IP address of his Troll he could have just looked in his registration table on an off chance there was a match.