>But a question (maybe a stupid question) - as far as SQL Server is concerned, isn't the request coming first through the web server? (I'm assuming you're trying to trace IP addresses from the outside). Can't your web app/web server capture the IP addresses in web logs?

No, not in that case. We have an external source who built a .NET application using the .NET SQL Client Data Provider to query our database directly. This is still under investigation. We have not yet found who authorized this.