I am still convinced there are hackers in Ontario - probably on Rogers Cable but also coming from Shaw and other networks. I think they move around.
After implementing a new filter we just got a bunch of hits in a row on pages without referrers from Toronto IPs.