fake ips on isa

hello,
i think i am being spoofed. i can see fake ips on isa sessions and when i look at the isa log files. eg 61.152.102.44. which is different from my private ip (172.16.x.x). i have actually gotten report about these ips spamming some site. i have checked my isa ip for smtp relaying, and open proxy and its safe.
how can i block these ips. Note that my isa is behind a firewall and its is the only machine permitted to go out using NAT thru the firewall.