I don't see evidence they aren't logging the wrong source IP (which is the default format with nginx, which the author is using).

These are extraordinary claims, which require extraordinary evidence.