You could trace the terminal ID to its corresponding IP address using SMF Type 119.
SMF 119 - subtype 2 records connection TCP connection terminal records.
You might need MXG to process SMF type 119 records.
If you have MXG, then
Create a PDB with Type 119 records.
Look at TYP11902 dataset in the PDB.
TTTELUNA has the TERMINAL ID(LU name)
TTRIP has the IP address of the terminal.
You can cross verify your finding, by making sure the password was revoked at the same as the SMF time on Type 119 records.