The IP should still be visible in the webserver logs. Those are the ugly looking plain text things, not ones done by nice looking programs.its looking like he exploited Drupal- therefore there isn't a log.
Though depending on the host and way of accessing it, you may not have access to those. Either way though, it's nice to see the site back up and running again instead of a database error message. Missed it