Can you post the output of 'netstat -tu' on that box? And can you test if you can actually connect to port 22 on his public IP?
First of all, thanks for Your reply!
No, I Cannot connect to his port 22 So it is closed. The netstat showed the unknown address, but I told him to check the 'env', where a variable (i don't exactly know what's the exact name without a linux shell) shows the current "real" SSH connections. And here, we Cannot see the IP. So that was another type of connection. Secondly, I told him to disable the Transmission, and when he did it, all of theese secret IP addresses disappeared.
So, mistery solved!
Thanks nas-central the lot of help!