Websites running on IIS involve multiple identities, and this can be confusing.   Explaining the details of the configuration requires a book, or at least a long article. Here are a few main points.

The main concept can is that each website uses an app pool.  Each app pool is not a user account, but can take the identity of a built-in account such as NetworkService.  However, by default, each app pool is configured to use built-in account ApplicationPoolIdentity that is not a real user account, but essentially means each app pool uses its account (IIS AppPool\AppPoolName, e.g. AppPoolName could be DefaultAppPool) created by IIS automatically.

If interference between websites is a concern, use a unique app pool for each website.  This is the default.  If memory consumption is the top concern, use DefaultAppPool for all websites.

Built-in account IUSR is used for the anonymous user identity by default.  In this case, one needs to give appropriate permissions to IUSR.  In some cases, the anonymous user identity may need to be set to Application pool identity (IIS Manager > Authentication > Anonymous Authentication), and this takes IUSR out of the picture allowing one to need only to manage the permissions to the app pool (e.g. DefaultAppPool).

These two short articles are helpful:

Application Pool Identities

New in IIS 7 - App Pool Isolation