I'm a new user and don't have enough reputation points to comment so hopefully replying like this is fine. Great discussion. I thought I would insert a couple comments.
pipTheGeek, as you pointed out, this is much nicer in IIS7. You can set the site to always just use the app pool identity. Then you don't need to maintain 2 users anymore. This is great when you have 1 site per app pool, or all sites in the same app pool trust each other.
IIS_ WPG (without the space. This text sequence makes it italicized) is a requirement and isn't a consideration for impersonation. In IIS6, if you don't add a user to the IIS_ WPG group, it cannot be used as the identity of an app pool. The app pool will fail on the first attempt to use it. In IIS7, the user is injected into IIS_ WPG automatically so you don't need to worry about it anymore.
In terms of impersonation, it's not followed 100%, so you will always need at least read permissions for both the app pool identity and the anonymous or authenticated user. For example, if you use windows auth for your SQL Server connection string, it will always RevertToSelf and use the app pool identity rather than the anonymous (or authenticated) user's identity.
George, to confirm if you have impersonation set, use processmonitor from www.sysinternals.com. With that you can see what is being used on disk, and the properties of a line will show you if it impersonated or not. That's a free tool, safe on a production server and easy enough to learn.
Impersonation isn't enabled by default so if you don't see it in your web.config, it's probably not yet. However, if you're not the server admin, check the root web.config and machine.config too, in the framework\config folder, to confirm that it's not set there. Search for the word 'impersonate'.
Another side, whenever you see docs that talk about the ASPNET user, consider them old and for IIS5. What it really means in IIS6,7 is the app pool identity user.