My prefered way is to have them send an email to you. You can look in the email header and may discover the ip address of the sender's workstation. Our victim uses the IP address 10.1.1.2. This means that it is probably a Linux. Who wants to hack windows boxes anyway.
Information gathering The next step is a litte bit more difficult.
We have to figure out the tunnel source and destination addresses. It is best practice to terminate tunnels outside of the firewall because in case of encryption the firewall could not look into the packets. Therefore, we can savely assume that tunnel terminating routers are protected by access lists or sometimes by another router in front of them and his access lists. A scan with nmap will tell us more. A litte ICMP, TCP and UDP probing will tell us whenever the router has a loopback interface configured.