I'm scratching my head here. although I will be doing a major search for unauthorized software running. I have been getting tons of spam registrations lately so I followed this guide https://doc.tiki.org/How+to+Ban+many+IP+from+fake+registrations
The result was that almost all of the registrations came from the ip address of my server. could this be a spoof?
EDIT: After looking at the logs closer i noticed that even my own personal account is logged from the same IP which suggests a possible bug. Every account up until May 20th uses the Servers IP. which makes this a major quandary to determine the validity of some of these accounts.