It probably gets it from the X-Forwarded-For HTTP reader inserted by his intranet proxy.

http://en.wikipedia.org/wiki/X-Forwarded-For