How to get the IP of a user who executed a command?

You can use the last command which lists all users last logged in/out time:

> last
root     pts/1        10.1.6.120       Tue Jan 28 05:59   still logged in   
root     pts/0        10.1.6.120       Tue Jan 28 04:08   still logged in   
root     pts/0        10.1.6.120       Sat Jan 25 06:33 - 08:55  (02:22)    
root     pts/1        10.1.6.120       Thu Jan 23 14:47 - 14:51  (00:03)    
root     pts/0        10.1.6.120       Thu Jan 23 13:02 - 14:51  (01:48)    
root     pts/0        10.1.6.120       Tue Jan  7 12:02 - 12:38  (00:35)    

wtmp begins Tue Jan  7 12:02:54 2014

Since you have the timestamp of when the command was run, if you also know the user that ran it you can narrow it down to what IP was logged into the system as that user at that time.

The last command can show you who was logged in during what times.

If you have multiple users logging into the same account, this is one of the reasons you should not be doing that and make sure to give everyone their own account.