The IP address given by Khan starts 192.168 which is reserved for internal networks. Commonly given out automatically by routers. McGee would find a nearby computer in NCIS HQ using that IP address not the number 1 cyber terrorist.
When Tony is in the elevator with Ziva and an unidentified person he says " We just took down Ajay Khan, the guy who hacked into MTAC last month." When they leave the elevator Tony says "the FBI Security breach and Homeland hack last year."
Tony is saying that Khan was part of all three attacks but as he was half talking to Ziva, he didn't repeat the first one.
While in autopsy, Ducky hands Gibbs a photo while wearing the same gloves he used to autopsy the victim with Ebola. This could have very easily led to its spread and Ducky, being a medical examiner, would know to not let Gibbs touch anything that could be contaminated.