My WNR1000v3 is serving six people and two of them have decided that despite my warnings they're going to torrent heavily all day.

Not dealing with that crap I decided to reserve their IPs and set up port blocking 1000-65535 at all times of the day.

However.... looking at the log reveals that stuff is still going through. Half of the entries are saying:

[LAN access from remote] from <externalIP>:16001 to 192.168.1.7:18946 Friday, Oct 12,2012 22:47:05

and half are saying:

[Service blocked: BlockTorrents] from source 192.168.1.7, Friday, Oct 12,2012 22:46:26

Is this because of uPNP? Or does the 'block services' feature Netgear has only work with outgoing connections? Is there something that I'm missing?

If it is indeed uPNP, how could I effectively block their torrenting without hurting everyone's use of services like Skype, Playstation Network, etc.?