I just used packet sniffer to watch packets and protocols behind IE connecting to FTP -- when I opened desktop shortcut to FTP.
First IE tries to open anonymous access using password
IEUser@ddcom.com (this one is stored in HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\EmailName).
After anonymous access has been refused IE recovers from its (or hers:) storage my user name and password for this particular FTP and finally connects.
Then IE issues several regular ftp commands:
opts utf8 on
syst
site help
PWD
TYPE A
PORT 192.168...
LIST
and receives back list of files and folders found in current FTP directory. TCP protocols used: ftp and ftpdata.