If I understand well, the winnt mpm allocates one thread for each keep-alive connection. So 10 000 connections require 10 000 threads even if 9000 connections are idle. On the other hand event mpm does not use threads - and so memory for thread stack etc. - for idle connections. So it can serve the same 9000 idle plus 1000 active connections with only 1000 threads.
For example on an IIS 7.0 server at this moment we have 2800 established connections, 120 seconds connection timeout. The two IIS Worker processes use 25 threads together. I have no idea where to look for the count of threads used by http.sys or some other unknown component which participates in serving HTTP, but the whole computer runs 500 threads.
