I would also suspect Skype. I run a network whose firewall is Ms ISA, and whenever a user fires up Skype, ISA reports that the number of concurrent connections from such a user have exceeded the set limit, and so on and so forth, include something like an intrusion has been detected coming from that particular machine.