I see that "/userhost <nick>" does add them into the IAL after i've done an /ialclear to remove them from the IAL, however I don't see /protect and /ignore behaving the same way as /userhost does.
That's exactly my point. :p
/userhost <nick> generates a RAW 302 event, while /protect and /ignore only generate a green info message. It appears to me that the 302 Raw is what's adding their address to the IAL.
I don't know how/why /ignore adds their address mask to the IGNORE list without bothering to take the effort to also add it to the IAL, since it 'knows' it in order to add it.
/dns, /ignore, /protect, /ban, /guser, etc all obtain the address in the exact same way, if it is not in the IAL, mIRC sends a '/userhost nick'. mIRC does not display anything from these internal userhost queries but the exact same raw 302 received, therefore it should fill the IAL with that info.
You can see the /userhost request and raw response if you type /debug @debug.
