If the agent's claim is true it wouldn't have come from an HTTP header anyways, but instead the IP address was leaked by the captcha part of the SR website, whi

If the agent's claim is true it wouldn't have come from an HTTP header anyways, but instead the IP address was leaked by the captcha part of the SR website, which the agent would have noticed on his wireshark-equivalent dumping TCP logs.