Source port numbers are normally chosen at random so as not to interfere with servers listening on "well-known" ports. If machine A is a client to machine B (e.g. B is your SSH server), then the kernel on A will normally choose a random free "high" port, because if it chooses port N, then this will prevent any potential connection from B to a server running on A and bound on port N.
However it is trivial to choose a specific source port; it is a matter of a simple
bind() call prior to the
connect(). For port values which are lower than 1024, on Unix systems, this requires
root privileges, but we can assume that the attacker is
root on his own machine. Why would an attacker do that ? Probably to fool badly-written firewall rules. Some sysadmins simply allow packets with low port values on the (mistaken) assumption that a low port can only be on the server side of a connection.
For the record, port 11 is for the
systat service, an old-style way for sysadmins to gather some runtime system information on their machines.