You can see the customer's IP address as part of the Customers->Orders display. Did any of the questionable orders come from an IPv6 address?