Check the efile record for each return. I think it has the IP address of the computer that sent the return.
