As far as checking who is connected to you, try this CurrPorts: Monitoring TCP/IP network connections on Windows

Last two numbers listed in LW's upload window will give you the last clue.

Unfortunately I do not know anything about VISTA, simply presumed its firewall would be more similar to Windows 7 than XP.

BTW if you want to make a host address permanent ban with LW, what I do is add /32 at the end of the number. I clear a percentage of my banned hosts out after a week or two, and some within a day. If I see the /32 at the end of the address I know it is intended to remain. The /32 is the CIDR format for representing just a single host.