The information that would help track isn't going to located in PPP exchange, it will be in certain HTTP requests the machine is issuing. For example, if Diesel had authorized his computer and bought a song using iTunes, certain credentials are going to be stored on his machine for the next time he hits the store. Now, if the thief hits iTunes Music Store and tries to buy something or yet tries to play a DRM protected song, Apple would be able to identify the machine using those credentials as part of the HTTP exchange. How else would apple know if you have authorized a machine in iTunes, if you don't send some information (beyond an IP address) to them? Continuing, if Apple has the machine on file as stolen (yes most definitely call them) and they say hey Diesel Geek is trying to buy something or is browsing the music store, they could record the IP address, determine if its Diesel or the bad guy, then pursue that person as needed.
I still like my craigslist idea! sneaky vigilante redemption.