An easy place to start could be your listener log - it will show you where any remote DB connections are coming from