basically your site listed my IP when I recovered my password as 162.158.78.154 this is not my IP. this is a cloudflare owned IP as my own site has had this same issue before. You need to make the users IP pass through in a header I believe to make it to your origin server.

here is the IP lookup page as proof that this is indeed the case aswell as a censored screenshot of the email I recieved https://whatismyipaddress.com/ip/162.158.78.154
https://imgur.com/a/fnjls