I was just watching my logs, and the following trio of events came in over a period of two seconds:

1143195321 64.151.75.252
GET /dropsafe/articles/news/post20050809161409.comments
PEAR HTTP_Request class ( [pear.php.net] )

1143195322 66.97.174.196
POST /dropsafe/articles/news/post20050809161409.comments
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; MyIE2; Maxthon)

1143195322 64.151.75.252
GET /dropsafe/articles/news/post20050809161409.comments
PEAR HTTP_Request class ( [pear.php.net] )

…so the first one comes in and retreives the page, parses the text boxes and other CGI elements; it passes it to another system on a different IP address which makes a POST (which is incidentally blocked by a text-matching algorithm) – and then the first one comes back to see if it worked.

An admirable amount of coding and synchronising, for something so bent.