... shows that an unregistered user attempted to create spam pages. Although it's possible to spoof the TCP source address of a packet as anything, it's not possible to establish a TCP session that way. Ordinarily only someone logged in to the OS should have access to the loopback interface. A locally running proxy is another possibility, if it exists. Either way, it warrants investigation.
I expect it's the frontend cache and/or SSL terminator incorrectly handling the forwarded headers. We were still very much testing that and the mobile detection in the frontend at this time. Haven't seen a reoccurrence recently, closing until it needs reopening?