Well, if the hack is reading the packet info to see where you are, etc, it could also identify your player/login name and hash.  From there the program could keep a table listing all player/logins seen and cross reference them to the hashes collected.  Just theory, I guess, nut he was damn annoying at ID-ing me pretty quick.