There are a couple of reasons why this wouldn't work.
1) If the hosting all comes from GoDaddy, it would be highly unlikely that they would assign 200
different Class C IPs for a single account holder (even at the $600 per month they would make).
In every instance that an interested company (e.g. ISP, host) wants a new IP address, they have to requisition it from their bandwidth provider and provide a reason for it; at least that's the explanation my host gave to me.
I have 12 Class C IP addresses, and it was pretty tough to justify all of them; about the only good reason a web design company would have is an SSL, which requires a dedicated IP. Most of the sites I build share an IP address because there's no need for them to have a dedicated IP.
Now...let's assume that the hosting was all through GoDaddy, and the person wanted 200 separate IPs. They're into $600 per month PLUS the cost of hosting (which is about $79.99 per month based on the cheapest dedicated server plan GD offers.) So you're up to $680.00 per month.
Now that we've covered that, let's look at the source of the IPs. Even if they're all different C Class IPs, they'll often be part of the same
B Class, the same A Class, or at the very least grouped into A Classes. Even if the spammer in question managed to pull off 200 completely different A Class IP addresses (which would be next to impossible with the same hosting company), the IP addresses can easily be queried to determine who owns them or at least who leases them (in this case, GoDaddy would presumably lease all of them or at least a
very large portion).
And therein lies a footprint. 200 GoDaddy sites interlinking with each other, even before the DNS server would be factored in (since it's even theoretically possible to pass these IPs through 200 different DNS servers on the same GoDaddy network, as incredibly stupid as it may seem.)
I'm not disagreeing with your network guy. I think he's right. The DNS servers would provide a very big clue in and of themselves, and
Google is an ICANN-accredited registrar, so it would be very easy for them to get this info (Yahoo! and MSN aren't listed, but they could easily set up a subsidiary registrar company under a different name and do the same thing). All I was trying to do was establish that, no matter how extreme a spammer was able to cover his/her tracks, the tracks would still show. Reality dictates that it wouldn't even get to the 200 A-class case I suggested, and that most spammers aren't that smart.
