Hi Paul,
Please disregard the last part of my previous post, because I just came up with a brilliant idea (ahem)! Instead of taking wild guesses at what may have happened, why don't we look in your logs to see what actually did happen!
On the assumption that the event 'ip-change' ran with an empty argument, you may search your /var/log/messages log file for such an entry. One way to do that would be:
less /var/log/messages |grep " ip-change" (<-mind the leading space)
On my machine, this returns several lines of the form
[something, date, time, something] Running event: ip-change 345.11.22.33
where the last bit's an IP address from my ISP's IP pool.
Let's see if you get a line back that says
[something, date, time, something] Running event: ip-change [blank]
If it's not in /var/log/messages, see if logrotate left some logs in the var/log/ directory that are called messages.1, messages.2, etc. and search for the line there.
If you do find an ip-change event with an empty argument, you can find in the appropriate log file when and why it occured. If you don't, I'm not sure where else we may look.
Regards,
Robert