"When people hack they use anoymizing Internet gateways, that conceal source IP addresses."
If a hacker uses the same software tool to accomplish his hack that no one else uses and you can detect the use of that tool in accounts that were hacked does it matter which gateway were used or how he covered his tracks?