Ah, quite true. I guess I've gotten a little elitist over time with my cable modem. ;) I totally forgot about dialup ISPs.
But with a little extra effort, I think direct evidence could still be established. People using locally-based ISPs - say, for example, the RATS-R-US ISP in the Peoples' Republic of Berkeley - are still all going to show up as *.ratsrus.com. So you could just pull out all the accounts that use that domain (almost certainly no more than a few in any given town) and examine their posting habits and times for any suspiciousness. And most national ISPs (not AOL, which is part of why I said "just ban them entirely") give easily identifiable localities in their domain names (say, *.phil.pa.earthlink.net). So you could just run searches against that. Etc.