It was done from one of the congressional offices so even if the person used VPN they just have to look at the network device logs to see who connected to Wikipedia or an external VPN and narrow it down from there. They're used to the Awan IT staff covering for them and likely don't know what can be tracked. They'll find out who did it, I'm sure Q already knows.