This is a bit confusing... What you mean by 'full node' here? Is there any alternative 'light' client for SpeadCoin? Isn't any wallet a full node? I don't get what 'leaches' mean here - are those wallets which are not yet synch-ed?
The difference between a wallet and a full node is that the full node allows incoming connections and that it has port 41678 open.
A normal wallet only initiates connections to the outside world (to full nodes ONLY), it never accepts incoming ones (exactly because its port 41678 is closed)
So basically full node in your definition is a node/wallet with public IP address, "listen=1" set in the spreadcoin.conf, and port 41678 open in firewall.
I don't think your definitions of 'full node' and 'leech' (this term comes from torrents afaik), are commonly used/accepted ones, but anyway, got it, thanks.
Why do you think the russian IP is a GPU farm? It might be a wallet behind a symmetric nat/firewall, which is just changing ports often, without properly closing old connections.