Well, there's the LW 5.1.2 version which was used heavily for spamming some years ago. They seemed to mostly disappear. I noticed recently I was connected to two at same time with same ip address. Then when I checked my logs since early in the year realised they've been connecting fairly often but in very small numbers. Their ips are so highly dynamic it's not worth blocking at hostile file level. UK & Portugal appear to be the two main places they appear to operate from (or using such ip's at least.)
I cannot imagine any normal person using LW 5.1.2. It was so basic and buggy. At GF we believed LW.org should not have released LW 5 until 5.3; even 5.2 version was still buggy though greatly improved. We believed LW.org were using normal people as beta testers for a program that was not up to scratch. I guess their continual financial income was at stake.
I did not bring this to your attention earlier because I didn't think LW 5.1.2 would apply to you. LW 5 was not wired to utilize GWC's.
Here's two very old samples:
Sample 1 and
Sample 2.
An edited connection log attached for past 6 months. There's a chance there's more of them out there but I was using the Light-Hostiles (NJ) which might have been blocking them out.