> You can't obviously connect an individual lurker to a log
I don't think that's necessarily true.
While I don't know if the IRC Server software supports it, there's no reason you couldn't encode some kind of unique tag into the stream of IRC messages sent to each client. Unless you were running two clients and diffing their logs you wouldn't notice.
It could be as simple as seeing additional events, or modified whois/client information on join/leave, or even completely fake client join/leaves.