Interesting. I assume you are blocking syn packets also?

What sort of web site is this? Do you run asp pages that have posting capabilities? Ecommerce? I'd almost imagine this is some sort of permissions problem where a script has too much authority or some such. Any data on what the web site in question does might help there. with IIS5 I'm guessing you aren't using any cgi/perl, just straight asp and html?