Doesn't help to determine why it's happening or who's doing it, but it will prevent it from happening.
For a short time. Yesterday there was a totally different IP used where WP and MP users were hijacked. My guess is tomorrow it might be another one.