Additional information: I caught it in the act, and something about this trigger and the setup is causing nginx to loop - the client ip address is actually right and nginx is proxying the request to itself as fast as it can. Restarting nginx stops the loop. This is version 0.7.65. I tried upgrading to 1.7.4 recently but the syslog support doesn't seem to work for mail and I haven't gotten a chance to try the old patches yet.