Relayed by ip: Blockchain.info - does this not mean that the hacker's IP has been relayed by a provider known to Blockchain.info?
"Relayed by ip" is the ip of the node that relayed the transaction to blockchain.info. It is not the originating node. However, in this case since the relaying node is blockchain.info, it must have originated there, and that means that the thief probably logged into your account to steal the bitcoins.
Wait, but why the 'hacker' stole only 4 bitcoin and not 'all the bitcoin', because I've checked the *transaction and a change/rest of 0.02883142
BTC returned to the input address (1JEBDTC8opFTiUmM19J1NY8D8h57rF7bgE).
*
https://blockchain.info/it/tx/4582dce49c12800cf78fdadec7b700c329e2e28629d3de770f8f2a3af60dae1f