Where are these "Client-IP-Address = 127.0.0.1" messages coming from?

[Matthew Schumacher]

I'm getting accounting messages like these that seem to be coming from
the loopback interface, but `tcpdump -i lo` doesn't see them so they are
not coming from a local client.  If they are not coming from a local
client then how can I figure out where they are coming from?

Thu Jan 12 07:19:58 2006
        Acct-Status-Type = Stop
        NAS-IP-Address = x.x.x.x      (legit nas IP)
        Acct-Delay-Time = 0
        User-Name = "user"
        NAS-Port = 536936515
        Acct-Session-Id = "0A000067"
        Service-Type = Framed-User
        Framed-Protocol = PPP
        Framed-IP-Address = x.x.x.x    (legit Framed-IP-Address)
        Acct-Session-Time = 0
        Acct-Input-Octets = 0
        Acct-Output-Octets = 0
        Acct-Input-Packets = 0
        Acct-Output-Packets = 0
        Client-IP-Address = 127.0.0.1
        Acct-Unique-Session-Id = "1cc41474b27ed376"
        Timestamp = 1137082798

Thu Jan 12 07:23:50 2006
        Acct-Status-Type = Stop
        NAS-IP-Address = x.x.x.x      (legit nas IP)
        Acct-Delay-Time = 0
        User-Name = "anotheruser"
        NAS-Port = 268501111
        Acct-Session-Id = "0D008123"
        Service-Type = Framed-User
        Framed-Protocol = PPP
        Framed-IP-Address = x.x.x.x    (legit Framed-IP-Address)
        Acct-Session-Time = 0
        Acct-Input-Octets = 0
        Acct-Output-Octets = 0
        Acct-Input-Packets = 0
        Acct-Output-Packets = 0
        Client-IP-Address = 127.0.0.1
        Acct-Unique-Session-Id = "4ed0aac222580a10"
        Timestamp = 1137083030