It finally occurred to me - and here it is for future reference.

When the proxy user calls the script, the resulting html output is fed back to him through the proxy server. EZProxy uses a predefined list of absolute urls that it should identify and rewrite on a page. Well, apparently it's not smart enough to distinguish between an actual link and some text on the page that matches one of its predefined urls.

I modified the script to send my debugging output to a local file instead of stdout, and lo and behold, there's

base_url = http://123.456.789.000

everywhere, unmolested.

Just shoot me now.

Thanks again for the help.