We used to have that happen before we went to ISA because we accidentally left the proxy "open". Somebody was routing their internet access through our server to cover their tracks. As for ISA, I'm still setting it all up myself, but I would say make sure you don't have any rules that inadventently allow external users external access. Brian