But the license has been granted from IBM to Apache, not to us. Unless and until Apache explicitly adds a specific grant of license to us, we're just eavesdroppers, with no rights to modify or distribute.
It doesn't have to be in every header; a simple document, just like IBM's, would be enough. Something along the lines of "This code is released to the general public under the terms of the Apache License v2", or whatever language you guys actually like to use.
Unless and until you explicitly release the code, it sure looks to me that IBM has given it to you, but not to us. I see no clear chain of permissions that would allow me to change and share that code freely.