mattcaldwell/pyutil — pull request #1 by tomatohater (2013-04-21 06:14:11+00:00)
Title: Fixed forwarded address extraction.

According to the StackOverflow article referenced (and recent first hand experience), the user's IP comes first.