mIRC uses the IP provided in the DCC request to connect to a user, not the /userhost reply, so this value is entirely up to the user. Unless the server or your router are modifying this incoming message, the IP mIRC connects to is the result of the DCC request message and nothing else.
To clarify your scenario, could you explain if you are the "destination CLIENT" in your scenario described above? If not, how do you know the destination PORT is not in the port range? Also, the destination client is the originating client (the sender is the one who receives the connection, unless passive is on), so how would the destination client be receiving the accept dialog box? Do you have passive dcc on?
