I agree with others, this is likely an image/media/link issue. I don't think nostream TS relay collects IPs, but you could easily set up your server to do so. Opening a DM with a tracked image would make this easiest to correlate, and is probably the most immediate thing to address. Or interacting with a thread with an image link that is being tracked could leak information via data correlation from the reply note time stamp. This information is leaked constantly, but that this person decided to dox people is a concern.

Being a bitcoin/nostr public figure has risks from many counterparties (governments, scammers, armed thieves). Pseudonymity is probably best practice where possible.