Should we may be adhere to convention you introduced to use 1.2.3.4 as the sample abuser IP? ;-)
Also I thought to suggest to use  e.g. 1.2.3.44 for those victim IPs someone might inject?
if you have proftpd running -- could you also try simulating injection and embedding few nice ones here?