how did he get my email? how does he know i backed up to time machine? what would you do?Your browser probably has a cookie that goes to the login page of your email service, which probably defaults to your name even if you type your password in manually every time. That page is likely near the top of your browser history. I do malware removal for friends from time to time and even after years of that I am still surprised by how much information is stored by browsers, and in how many places.
Same with time machine, the lists of what were backed up are probably stored on your HD in case you ask it to do a differential backup next time. All those little conveniences and preferences get squirreled away on your hard drive.
Your profile says you're in Oakland; with an underfunded police dept and one of the highest murder rates in California, you'll have to do your own detective work and give them an easy collar.
If you have the serial number, Apple can assist directly. If not, then there's still hope - the MAC address of your network card is often stored in firmware and may well survive a wipe of the hard disk and reinstall (even assuming the buyer is thorough enough to truly wipe the system). Do you use Wifi in your office? Routers often keep a log of MAC addresses and names of the computers that connect to them. Hardware routers can too, but they're more plug-n-play, whereas usually people configure the wifi to put a password on it and may have enabled the logging if it wasn't on by default. Failing that, since you have this person unwisely offering to help, at the very least you want them to copy your \system and \user folders in their entireties, preferably using some kind of automatic utility instead of by hand so that hidden files and stuff get included. So I say take them up on the offer, be pathetically grateful 'as long as you can get your settings and preferences back'. Having the MAC address won't help you find the computer, but it will help you verify that it's the one which was stolen if the thief hasn't been thorough.
Assuming the person actually comes through, there's a reasonable chance that you'll be able to find a log of the last IP address that was used, because they probably contacted you using your own computer. Could be in a coffee shop but if so they probably go there regularly. If it's associated with a residential address you're really in business. The cable or DSL company will probably be willing to tell you if that is the case as long as you don't ask for the street address or subscriber name, because then you can give that information to the police and the cable company won't mind giving it to them the way they would to you - getting a warrant for that ought to be very easy since a theft has occurred. You should report the theft straight away if you haven't already, you can fill them in on the technical details later after you have a case #.
If it is a residence, the police will take care of it. Having them turn up with a warrant is intimidating enough for most people, if they have printouts of system logs or something to wave around the thief/roommate/friend will probably spill everything they know, and try to give them enough information to track down whoever broke into your car. It's quite possible that the police already know this person but don't have an open and shut case to make a prosecution easy. Computer data can make for an impressive looking evidence trail, which can lead to a nice story in the local newspaper - 'cops and DA nab thief using computers tracking data'. Good publicity, pleases the taxpayers, deters a few wannabes.
If the offer to send back your data is just a cruel bluff, don't give up. You run a website, presumably you log in there all the time. If it's your start page or a favorite, there's a chance that the person opened it in the browser by accident or out of mild curiosity - people are nosy that way. Look at your visitor logs and see if there were any failed connection attempts to your admin account or whatever you have, and what IP addresses they came from. Of course you'll probably have a stack of new connections starting right after your HN posts from people like me. Look at the email timestamp and start tracing logged IP addresses about 90 minutes on either side of it - anything within say 20 miles is a possible.
That's enough to be going on with. Take the person up on the offer, maybe with some mealy mouthed words about how you don't have much alternative, suggesting (not explicitly!) that you tried the cops and they were indifferent. Say something pissy as well for credibility. Beg a little for your system and root directories - look at someone else's Mac, I don't know offhand how big those folders get. I would ask for the stuff on DVDs if that does not seem unreasonable: those can be got at Walgreens and the person is much less likely to blow off a trip to walgreens than a trip to store to buy a hard drive; they take fingerprints better than a hard drive will; and the lead-in data may contain forensically useful information.