"target every cookie that belongs to a specific IP address"
That shouldn't work if the GP uses a VPN, as theg'd have a perceivably different IP address.
More likely they are logged into youtube, and their account has been associated with their girlfriend's account (location data from gmail/android phones/maps/etc, probably not using the VPN 24/7, etc)