Please override this function and allow within the ACP the ability to specify our own header to check for proxied IP addresses. Why our own? It is very easy to spoof but in my Varnish cache I can set any header I want to the real IP, tell XF the name of it, record the real IP and strip it out of any returned headers to the connecting IP.
For the majority of users simply allowing an input box and a checkbox (header to check for, check for headers) will suffice.
For now I shall have to modify the ZF source file to accomodate.
Btw, this will also fix the issues in this thread: