brokaddr - 3:55 am on Apr 26, 2012 (gmt 0)

The user appears to be spoofing their IP, is what I am trying to say.
All other users have legit remote host / remote addr fields, except this particular user.
All they've been looking at for the past few hours is images.