I've found the speed address, I haven't had enough time to find the pointer though, how I found it is by running normally, then search for float 1 (3F800000) then run in shallow motionless water, the value should now be 0.7, you can figure the rest by yourself.
Edit: Ok so, apparently the address changes as per area, Colony 9 area address is 00B45764, and Colony 6 address is 00B92794