DHCPDECLINE messages question

[Dennis Dufford]

Ran into a new problem.  A client has complained that the dhcp server "changed" his IP.  When checking the log, this is what I find:
 
Sep 18 02:13:31 hw1ns2 dhcpd: [ID 702911 local7.info] Added new forward map from AMOOREXP.hw.syniverse.com. to 172.28.41.179

Sep 18 02:13:31 hw1ns2 dhcpd: [ID 702911 local7.info] DHCPREQUEST for 172.28.41.179 from 00:11:43:42:b7:b2 (AMOOREXP) via dmfe0

Sep 18 02:13:31 hw1ns2 dhcpd: [ID 702911 local7.info] DHCPACK on 172.28.41.179 to 00:11:43:42:b7:b2 (AMOOREXP) via dmfe0

Sep 18 12:46:48 hw1ns2 dhcpd: [ID 702911 local7.info] Added new forward map from AMOOREXP.hw.syniverse.com. to 172.28.41.179

Sep 18 12:46:48 hw1ns2 dhcpd: [ID 702911 local7.info] DHCPREQUEST for 172.28.41.179 (172.28.198.20) from 00:11:43:42:b7:b2 (AMOOREXP) via 172.28.41.12

Sep 18 12:46:48 hw1ns2 dhcpd: [ID 702911 local7.info] DHCPACK on 172.28.41.179 to 00:11:43:42:b7:b2 (AMOOREXP) via 172.28.41.12

Sep 18 12:46:48 hw1ns2 dhcpd: [ID 702911 local7.info] Added new forward map from AMOOREXP.hw.syniverse.com. to 172.28.41.179

Sep 18 12:46:48 hw1ns2 dhcpd: [ID 702911 local7.info] DHCPREQUEST for 172.28.41.179 (172.28.198.20) from 00:11:43:42:b7:b2 (AMOOREXP) via 172.28.41.11

Sep 18 12:46:48 hw1ns2 dhcpd: [ID 702911 local7.info] DHCPACK on 172.28.41.179 to 00:11:43:42:b7:b2 (AMOOREXP) via 172.28.41.11

Sep 18 12:46:48 hw1ns2 dhcpd: [ID 702911 local7.error] Abandoning IP address 172.28.41.179: declined.

Sep 18 12:46:48 hw1ns2 dhcpd: [ID 702911 local7.info] DHCPDECLINE of 172.28.41.179 from 00:11:43:42:b7:b2 (AMOOREXP) via 172.28.41.12: not found

Sep 18 12:46:48 hw1ns2 dhcpd: [ID 702911 local7.error] Abandoning IP address 172.28.41.179: declined.

Sep 18 12:46:48 hw1ns2 dhcpd: [ID 702911 local7.info] DHCPDECLINE of 172.28.41.179 from 00:11:43:42:b7:b2 (AMOOREXP) via 172.28.41.11: not found

 

 

In checking my logs for the last nine days, about 2,500,000 entries, I found only the above two DHCPDECLINE entries - toatal.  Does anyone have any idea why a WindowsXP box would just up and:

A)  do two cycles of DHCPREQUEST & DHCPACK, and then:

B)  do another DHCPREQUEST and then DHCPDECLINE the same IP?