They could. The protocol also supports IP spoofing, so doxing could also be a thing.
For individuals, it is a time consuming and costly legal process, whether justified or not. For the law firm, it costs a few cents per letter, but they get a few hundred (or more) euros when some sucker pays.
In Germany and no doubt some other countries, private law firms can (on behalf of the copyright holders) request people's identity based on residential IP addresses and then send extortionist legal threats. Apparently an IP appearing on a public tracker can be enough to trigger it, without any confirmed data transfer.
VPNs are common and usually sufficient.