OK, so I am going to get back on my soap box and yell at you again.
Remove all together any reference on the external side that has to do with anything, portforward, port trigger, etc. that reference a well known port. I know you may still need to leave 443, 25 as is; so for those, make sure your server is locked nice and tight. Port 8080 (not meaning to sound rude) is a typical web port, being for UIs or not. Turn that off. What they are doing (most likely) is a port scan, and they see 8080 as an available port. Because it is 8080, DoS and buffer overflows are typical webserver attacks. Since that port is also being forwarded to your server for RDP; and if they figure this out, that will put your server in a very dangerous situation.
I am glad to hear that you hard coded those addresses on your router, very smart. The bummer part is that those are only a tiny slice of addresses that may pose a threat. If you are running an email server and use a service like Postini, make sure that you have rules in the firewall that only allow mail to and from the Postini servers, and nowhere else. For ftp, I would either turn it off, or just give people access to it only when needed. If you use it all the time, then make rules that would only allow your IP to access it. I am sure, that we have other denied connections that may also reference port 8080 directly.
Keep us posted.
EDIT:
Your above post said that you were able to RDP to your freind's box with no problem, I am not surprised. I have never thought the problem to be on your machine. There is no question the router is either denying the connection, or just getting confused. With the added info of your IPS log, I beleive the router may be seeing the RDP connection on 8080 as an attack. If so, we should have log entries.
