I think you're thinking of the Melissa virus https://en.m.wikipedia.org/wiki/Melissa_(computer_virus) which did indeed get tracked back to its author like that.