checkmailpasswd FAILED - one ip - ours, one ip - attacker. please help

[JackDee]

hello,
i notice a line in my log file like this:
IMAP connect from @ [::ffff:2.187.25.14]checkmailpasswd: FAILED: admin - short names not allowed from @ [::ffff:2.187.25.14]DEBUG: Connection, ip=[::ffff:x.xxx.xxx.xx]: 1 Time(s)
now the thing is that: 2.187.25.14 - is ip from iran... it's not ours! probably attack.
but the ip that i changed to x.xxx.xxx.xx is our ip... what is that mean exactly?

also i saw another line:
IMAP connect from @ [::ffff:2.187.25.14]checkmailpasswd: FAILED: admin - short names not allowed from @ [::ffff:2.187.25.14]IMAP connect from @ [::ffff:x.xxx.xxx.xx]INFO: LOGIN, user=ouremail@ourdomain.com, ip=[::ffff:x.xxx.xxx.xx]: 1 Time(s)

can you please help and tell me what it's mean? i know it's bruteforce attack but why one of the ip is ours and one is attacker?

Thanks
Jack