Is it possible to use information in an access log to identify the true identity of an impostor who has acquired unauthorized access to a computing system (Perhaps by combining several different pieces of information )?
I'd say the answer is possibly. As you have a web server (LAMP stack comment) you have access to the web server logs, so you could log quite a bit of information about visitors to the site, and you might be able to use that to specifically identify someone visiting the site regardless of who they log in as
If you look at something like panopticlick
If you then have access to the client systems of the potential imposter you could use the browser fingerprint to provide evidence that it was them who accessed the system.
Of course if you have a clever attacker they may take steps to foil this approach (anonymising their browser, changing systems etc)
You will be able to log IP addresses, but this is far from "true identity", since one can use proxies, chain shells and so on. Most likely the answer to your question is "no"
Theoretically, the system will not be able to detect unauthorized access, as a false authentication must have taken place first. If it could, there wouldn't be any impostors. How a specific system deals with logging is different in each case. Most, I guess, will log IP addresses, but more detailed information is hard to log.