Ask HN: How much user data can I get from user via web browser

Alright, this is serious. Someone stole the password of our customer and now he logins using this password. We need to know who he is. We currently log IP, session_id, login and logout time but this is not enough to know who he is. IP addresses are mostly dynamic, session_id changes so we need another solution. Can you give an example what other things that we can collect. Is it possible to found his address, name etc somehow?