It seems that Cloudflare’s notice is legitimate.
The email is properly authenticated, and since the server hosting provider also contacted me and even opened a support ticket, it’s probably real.
Therefore, I need to find an alternative provider to Cloudflare — one that supports original IP...