ah yes, that would indeed be that (only new since WLM 9.0) MPOP feature where Messenger sends out a
Machine GUID. If you would check that* and compare it to a previously stored one, then you could say he has logged in from "another" location. But you indeed couldn't say if that would be his normal location or not (unless you kept statistics I suppose), which was what we understood from your question.
But also note that you can extremly easily change that Machine GUID (you're not suppose to though). So it wouldn't be that super-reliable either....
* This can only be done with a so called sniffer or a proxy.
MD is a proxy; it sits in between Messenger and the outgoing/incomming messages, thus acting like a proxy (which can cause a hell of a lot of trouble if not done properly. Messenger Plus! scripts can not act as a proxy (yet).
A sniffer is a tool which sits on top of everything else and which monitor internet traffic. Such tools can't change something, like a proxy can, but they can 'see' the stuff being sent and received.
/ 
