If the user has a active database session, then i would check the V$session table and also check the listener logs which should cite out the IP address.
You should also look into "How To Find The IP Address Of The Client Machine From Where A Particular Forms User Is Connected ? (Doc ID 879092.1)"
Hope it helps
Well, At the end, We have identified some suspicious IP address from the apache logs, and forwarded that IP address to the network team for investigation.