Not sure why so many top comments dismiss the severity of this. This is just exactly the type of attack that give law enforcement or a malicious actor a way to establish proof of whereabouts.
I believe most people (me included) dismiss the OP's claimed severity, as if it is being oversold. I see a balance of opinions saying "great find, but not as critical as claimed" so they don't seem dismissive. It is important to correctly classify the severity of issues. Proof of whereabouts is not deanonymization, especially when the abouts are so loose
Even knowing their country from this would be a big first step.
They dismiss it for the same reason people dismiss disruptive new technology - they are uncomfortable with it. It's a signal (ha) that the threat is very real.
First dismiss it and see if the problem is still there in the morning. Hope that before then, someone finds a reason it's not a problem. Anyone?
I would guess some are just jealous of his age, but some do find the claim of de anonymizing to simply be overblown given it doesn't tell you nearly enough to find anyone except in very niche cases. This "attack" is easily defeated with a VPN or living in any major city.