Yes that is correct.
This rule is for 2 reasons:
Someone using a free proxy to "hack themself", then when Admins check the IP was in fact different. You were hacked via not securing your account, so the losses are liable to you.
Either way, yes the person is liable.