I'll agree with Theo tho, it's a Comcast address, not an AOL one when you do a reverse lookup on '24.91.141.172'.  If you run 'last' with a couple different flags, it will present the IP/host in their entirety since it will place it in the last column, with either the FQDN of the IP, or just the IP.

Ex.

#> last -a   (or 'last -ad' for that matter)

userxx     pts/0        Sat Dec 15 20:45 - 21:18  (00:32)     c-24-91-141-172.hsd1.ma.comcast.net

#> last -ai

userxx     pts/0        Sat Dec 15 20:45 - 21:18  (00:32)     24.91.141.172

If Comcast is your ISP, then there is a topology where this would just be you, but I'm pretty sure you'd know that it was yourself since it takes some effort to setup.  You'd have to be doing NAT'ing/Port-Forwarding on your cable modem or router for the SSH port to your Linux box, and ssh'ing into your Linux box on that external address (which would probably get associated with dynamic DNS updates from the router/modem) from your local net.  Since you were taking that route, you'd get NAT'd to the router/cable modem's external IP (or a global NAT IP you have configured to present to the internet for outbound connections), which would show up in the 'last' output as that IP/FQDN of that IP.

Are you ssh'ing into your Linux box on it's internal LAN IP or at it's external public IP?  What IP gets reported back to you when you go to http://whatismyip.com from the box you ssh into your linux box from?  Like I said initially, I'm pretty sure you'd know your network and system set up, and would know if this was actually you are not.

Now all of this is completely moot if your ISP isn't Comcast.  And from looking at your email headers, I see a few hops of yours mills-curran.net (206.130.122.207) & cheapo.curran (pool-108-20-153-93.bstnma.fios.verizon.net [108.20.153.93]), which obviously aren't Comcast.

FWIW, my best practice is to implicitly deny all SSH connections and explicitly allow only the ones I want in /etc/hosts.allow.  Makes it a PITA when I'm on a new network for the first time, but it definitely adds another layer someone has to work around to get in.  If you block 24.91.141.172 in your hosts.deny, do you get 'refused connect from c-24-91-141-172.hsd1.ma.comcast.net (24.91.141.172)' messages in /var/log/secure (or the Debian equivalent, I think that's what you are running based on some of the mail headers).

Dave