An update on this, for the archives. SOGo support is telling me:
If the IP addresses are legit, it them means their session has expired. So the entires in both memcached/the database for the user session are gone, while the user tries to use it again. There's nothing to worry about, it just means the user was brought back to the login script of SOGo.
-- users@sogo.nu https://inverse.ca/sogo/lists
