That's true for the IP but why don't you try to get the original resume and look through the document metadata? Apart from that the IP seems more viable as more people mentioned in the comments. You could move the email address to span and as for the calls probably block or respond and say that you never aplied?
But this seems like impersonation to me.