What you are seeing on the review page could happen like this:
- Student starts the attempt.
- Student inputs an answer to each question .
- Student clicks 'Next >' to get to the Attempt summary page.
- Student clicks 'Return to attempt'
- Student reviews their answers and changes them.
- Student clicks 'Next >' again then 'Submit all and finish'.
But, it is odd that their answers changed from right to wrong.
And, the observation about a different IP address is weird. There are situations where a student's IP address can change suddenly, but (depending on which sort of device the student is using) they are probably unlikely.
Moodle does not stop a student logging in from two devices at the same time (or two different people using the same login at the same time.) (There are plugins which try to do that, I think.)