If websites can obtain your general location from your IP address, SE should be able to do it as well. A basic location check (instead of just an IP check) would likely do wonders for slowing down these issues, until they are able to do something about the session ID concern.