W/re more disks - I think instead of going RAID 10, which would cut in half the reliability (vs the current RAID 1), ie, same data now has to come from 2 vs 1 working drives; I'd be more inclined to go with SSD disks and stay with the RAID 1.
Umm ... I think there's a flaw in your reasoning here. RAID 10 is not a reduction in reliability over RAID 1. RAID 10 is a stripe of two or more RAID 1 arrays. While the RAID 0 stripe could theoretically fail if both halves of a component RAID 1 array fails, that's really no different than what you have now with RAID 1. The array as a whole is 100% redundant and will keep running if any drive fails.
The "same data coming from 2vs 1 working drives" is not an accurate statement. RAID 10 means that the server can pull from *either* of the mirrored drives within the array, not both. That's all the reliability of RAID 1 with twice the speed (broadly speaking). The same data being available from multiple drives is a *benefit* not a liability. In a basic four-drive RAID 10 array, the server can be accessing four drives simultaneously with four different requests compared to a two-drive RAID 1 array where there are only two simultaneous requests possible.
Personally, when I have more than two drives I prefer to run RAID 5 (with a hot spare if I have more than three drives). You get redundancy, comparable performance and more usable storage for the same number of drives (n-1 or n-2 instead of n/2). Mirroring uses too much space and doesn't provide much (if any) of an improvement in reliability.
Regardless, before you even look at adding drives cram as much RAM as you can into the box - the kernel will use it to cache the disk traffic, MySQL will cache queries - Not only does that free the drives to serve additional traffic, it's an order of magnitude faster to pull from cache than it is to pull from disk.
If after adding RAM you still feel you need to add drives, I'm with Martin - don't replace what you have, leave it in place and add to it. The more physical drives you can spread the data over, the better. Add more drives to the existing array or add a second array and split your data between them - for example, but the webroot on one array and the database on the other.
SSDs are overkill for anything but the largest sites, and even then I'm not convinced they're going to land on the positive side of a cost/benefit analysis. If you're going to double the cost of the server by going with SSDs, buy a second server instead and run your database on it. Additional RAM for cache and/or separating the database onto a separate server will provide a much greater impact for the money that paying a premium for SSDs.
Part of this question has to do with how Moodle "keeps a user logged in" - to my eye it's using IPaddr logging - is this correct? Or is such via cookies?
Cookies and session files, not IP address. If you want to simulate a bunch of users hitting the server, take a look at using JMeter or Selenium. Those tools are designed to test web applications like this.