assume the perp is reasonably smart
step 1 - run an open WiFi hotspot in a popular location
step 2 - harvest all the MAC addresses you can
step 3 - repeat in several locations
step 4 - spoof a random assortment of those MAC addresses when using the net for nefarious purposes
step 5 - wait until they start looking for one of them and move to another