The "ip" field used to hold the plain IP address, so it's still called that, even though it now holds a hash.

The post() function fills it in like so:

  $query->bindValue(':ip', isset($post['ip']) ? $post['ip'] : $identity);

It's called from https://github.com/OpenIB/OpenIB/blob/master/post.php#L988, but $post never gets an 'ip' key, so it always uses $identity (which was created using getIdentity(), which currently hashes the IP address).

I think the method you describe for checking whether a post could have come from an IP address would work, if they gave up all the relevant salts. secure_trip_salt isn't supposed to change. hashSalt is also needed, because the IDs are generated using the hashed IP addresses, but it's changed infrequently from what I remember (changing it logs out all moderators because sessions are tied to IP addresses, so it's easy to notice).