Doesn't help to determine why it's happening or who's doing it, but it will prevent it from happening.
For a short time. Yesterday there was a totally different IP used where WP and MP users were hijacked. My guess is tomorrow it might be another one.
Valid point! I had assumed that it was a fixed IP, however either way can't hurt at the moment.