It probably gets it from the X-Forwarded-For HTTP reader inserted by his intranet proxy.<p><a href="http://en.wikipedia.org/wiki/X-Forwarded-For" rel="nofollow">http://en.wikipedia.org/wiki/X-Forwarded-For</a>