They just said an IP can't solely be used to identify someone. You can use the IP address to get the name and then acquire additional information to prosecute the case. But you need to start with the IP address to get the ball rolling.
(I'm from Europe, asking out of curiosity.)
It's not enough to be used as evidence in court.
Most likely did the majority of the bots use proxies and VPNs, which may or may not provide additional information about their customers, but even then it has to be proven that is was the same user that did the acts which is very difficult.