The IP address on hand is probably the hotel's public address used for NAT, especially in 2012. This means you'd need to have full NAT logs + source port + something like a captive portal setup that forces the user to identify the room to be able to tie (externalIp, sourcePort) to (user, room). The captive portal type isn't unheard of for hotels, even in 2012, but the NAT logs... it's no surprise they had to ask for the room list.