- He uses a proxy website
An IP address lookup will reveal the exit node for that website proxy, e.g. the IP address of their server they connect to the IP address lookup PHP script.
(Client)---(Web proxy)---(Web proxy/exit node)---(Web server)
- He uses a proxy through browser settings
The revealed IP address will be the proxy server. However, depending upon whether a transparent, anonymous or elite proxy was used will determine if the proxy server forwarded the remote address (your IP real IP address) within the packet header.
Also, you should review the proxy server types (FTP, HTTP, HTTPS, SOCKS4, SOCKS4A and SOCKS5). An HTTP proxy server can only serve HTTP content via port 80. So, if you connect to an HTTPS website, your real IP address will be exposed. However, using any SOCKS proxy server would server content via any usable port.
(Client)---(SOCKS5 proxy)---(Web server)
Exposing the real IP address because of using HTTP proxy to connect to an HTTPS server.
(Client)---(HTTP proxy)---(HTTPS web server)
- He uses TOR browser bundle to access Protonmail hidden service
The Tor browser bundle is configured to prevent leaks like I described above, let alone protects against DNS and WebRTC leaks (by disabling). So, the exit node for the web server it accesses will be the IP address you view. Because of the Tor client changing circuits for different websites, the exit node for ProtonMail.com will be different for IPChicken.com. Hence, a different IP address.
(Client)---(Tor entry)---(Tor relay)---(Tor exit [IP address not static])---(Web server)