If you own the website and the network the user is connecting through, it is relatively easy to use heuristics of the traffic to correlate users on a site to the person connecting to the VPN. This is already available in firewalls which can detect applications/viruses using encrypted traffic.

A less covert, but far more effective way is to just start sending packets of specific sizes/timing in bursts and see where they show up in traffic from the VPN provider to suspect users in China.

Without access to both the site and the user's network, you can eventually locate people by monitoring latency and loss on the links you suspect the user is connecting through. I do this to identify people in video games to root out spies in my group and all I need is root access to our group's and user-level access to the enemy group's voice servers.