If abuse is an issue, why not hash the IP with a nonce?
Or for audit purposes (e.g. you might need to prove to some regulator no outside access was made, which is stupid but ...)