How does repudiation/non-repudiation work in such cases ?
As a legal matter it depends on the jurisdiction for standards of definition and process for reaching a finding.
In a simple technical or logical sense you need to connect evidence with an individual. I believe in many similar US court cases this is done either by precedence or admission.
First you must have evidence of an illegal act. In this case the charge is copyright violation, and the evidence is electronic monitoring of a device on a network advertising files for download. The files advertised by the device include audio recordings protected by US copyright laws. The identity of the audio recordings may be confirmed by downloading the files from the device and either listening to them or digitally comparing the file to the original recording.
The next step is to attempt to uniquely identify the device. This is usually done by IP number. As noted by the original poster, there are problems with using IP addresses for identity. However is most cases, where the user of the device is unsophisticated and has not attempted to spoof, obscure, or obfuscate the IP address, this is a moderately good means of identifying a device.
The next step is the hardest to prove conclusively, but may, depending on standards of evidence, be easier to prove in court. That is who caused the network device to share the audio recordings? This requires chaining identity from the IP address to the device to the individual.
For casual repudiation all the individual needs to do is break one link in the chain from IP to device to individual. The required strength of the repudiation argument depends on the evaluator of the argument. In legal matters this would be a magistrate or jury.
The link from device to individual may be hard to prove. If the device is in a location where multiple individuals have physical access to the device a plausible argument may be made that any of the individuals with physical access caused the device to advertise the copyrighted material.
Likewise the link from IP address to device may be difficult to prove as spoofing IP addresses and listening for IP traffic destined for other IP addresses is trivial to do. Again the requirements for this argument depend on who is the evaluator of the argument.
I suspect in most of the legal matters the injured party (the copyright owners) use a slight amount of technical information and intimidation to coerce the alleged infringer to admit to the illegal act. I suspect if the alleged infringer was uncooperative and had a barrister to represent them that proving the links to identify the individual would be difficult to prove in a legal setting.