4
In NTFS, owner implicitly and effectively (you can write DACL, granting yourself any permission) has full permissions on files (IIRC folders as well), despite DACL entries. Reference
Workaround is to use special SID in DACL: S-1-3-4 "Owner Rights"
It replaces implicit permissions with explicit ones defined by you.
2
If by loopback you mean a network connection only to localhost, consider AF_UNIX sockets. AKA UNIX domain sockets. AKA that non-IP way you can connect to PostgreSQL or MySQL databases.
On Linux, this has the advantage of respecting file permissions. Without write to the socket as your user, it will not work. Probably, this behavior isn't standardized.
IP ...
1
The group BUILTIN\Users has Write Access to your C:\Site1-Logs directory.
The user IIS AppPool\Site1 is automatically a member of the Users group because that is a special group under Windows.
This is why your web-site has write access.
You can't remove IIS AppPool\Site1 from users, but you could remove the permissions of the users groups from the directory.
Only top voted, non community-wiki answers of a minimum length are eligible