Under the module admin/Protect Center section there are a list of addresses and I have cleared all references to this members IP addres. I have htaccess files on the site but they are all not updated for months. Is there no way to find out which rule caused him to be considered a threat?

I've run a sql command verifying his IP is not in a table.

select * from xoops_protector_log where ip='10.220.119.88';
select * from xoops_protector_access where ip='10.220.119.88';

Is the Reliable IP a white list? I see loopback and a non-routeable IP used by default. Just curious what this setting does. I will ask him to clear cache and cookies.