Lead Source is a standard picklist field. It contains values that describe where a lead was obtained from in a general manner, such as from the web, from an email, etc. This list is customizable by administrators.
However, Salesforce allows you to capture any value you want in some cases. For example, a Web to Lead form on a website can insert any value it likes, so long as it doesn't exceed the maximum value length, even if the value doesn't exist in the picklist.
Also, when performing imports from other systems, either through a CSV file, a third-party lead service, or API-based software, such as the Data Loader or Relation Junction, they can generally inject any value they would like without regards to your available options.
It's also possible to delete a value from the list without altering existing values, so the value could have been legitimate in the past, but is now defunct. You can always use the Replace function on the field to mass replace all records that contain a certain value (e.g. Website), with another, currently legal value.
Note that once the lead has been edited to a legal value, you won't be able to use the UI to set it back to the invalid value, as it will disappear from the list.
Assignment rules always fire for web-to-lead, and the assignment occurs after the initial database commit, so the owner field would be clobbered by the assignment rule. Furthermore, if the rule fails to find an owner, the default lead owner is used instead. So, in order to prevent the rule from changing the owner, there must be an entry that uses the "do not reassign owner" checkbox. This prevents the default lead owner from taking over the record.
Best Answer
Standard Web-to-lead forms can take advantage of Lead Assignment Rules. These rules basically govern the assignment of ownership based on the criteria that you setup. Once you have your new Web-to-Lead form in place using standard web-to-lead, you can setup Assignment Rules.
Regarding your workflow rule and custom web integration, it's hard to debug without seeing the actual rule logic itself, and understanding the exact architecture of the website integration. Does it use a Visualforce page, does it use the Salesforce API, etc.?