Yeah... geolocation or IP addresses can be spoofed. But if it was the CEO's credentials, why in the world would you be getting the blame?