Remember that XP's firewall only blocks inbound traffic, it lets outbound traffic through unmolested. This post seems to back me up.
First of all, the Windows Firewall does not monitor or block outbound traffic. According to a PCWorld article, Microsoft technical specialist David Overton argues that "it is not the firewall's place to stop malicious code from sending outbound packets--Microsoft contends that companies should use perimeter technologies to examine outbound traffic."
However, I don't know how old the article is and I use Sygate Personal Firewall so I don't know whether this is still accurate, but this Wikipedia article says the same thing:
XP's Windows Firewall cannot block outbound connections; it is only capable of blocking inbound ones.