1) Find the first edit made by a user
2) Search for IP sockets with a spike in outbound traffic to Wikipedia at around the same time (editing a large section submits a large POST).
3) Follow the users' further edits, and do the same as above to keep narrowing the candidate IPs down.