I would still say double check the dispatcher logs to see what messaging you get when you hit it.  Set debugging for a few, hit the path for siteb through sitea url and see if there is any messaging on the path.  You might also try changing your deny from url to glob to see if that will block it.

Further, to find the process using the port, you can run cmd.exe as admin and run "netstat -abo"It will have an output like this. The PID is the far right number  TCP    0.0.0.0:4502          THISPC:0                 LISTENING       2708 [java.exe]

Check dispatcher.log to see what farm it is being served from.  It would say something like this:Found farm siteb for siteb.company.comIt is possible it is getting through using another farm definition.  I have seen invalidation_only serve content when it should not.

What part is not working?  Does sites still serve and siteb as well, or do neither work?  Is there anything in the dispatcher cache for siteb already?