Wow, that's really bad then. It's super simple for a user to fake a X-Forwarded-For header, so the real IP would never get logged in that case. See #10 for some more detailed info.