is moat taking the local IP from the shim?
From a conversation in irc. The last forwarded IP might be the IP of the moat-shim, which makes the request to https://bridges.torproject.org so apache will include the IP of the server in the forwarded header.