Also consider that the 25 users you know of are the ones that log in.  Unless you're going by raw http logs there could be many more anonymous users/bots

"getting the css, js, and images all count as separate connections"

This sound like they count http requests per page load separately. This would be very uncommon and if they limit the total number of http request to 100 for all users you can basically forget about hosting Elgg on the servers of this company.

A not totally untypical page load by your browser (profile page, index page etc) when the page is not yet cached could result in quite a number of http requests. I just made a quick test on one of my local test installations with the YSlow Firefox plugin: profile page load contained 56 http requests uncached and 2 requests after cached. If you have pages on your site with a medium/high number of widgets even a single user could use up the 100 "connections alone.

I would advice to host your site somewhere else. And even for a small site a VPS might not be completely unwise to choose.

To be very clear: Number of connections != Number of requests. Requests are not run all in parallel but rather use the available number of connections in parallel which is typically 6 - 10. The number of requests is irrelevant for this purpose. This should not be confused. 

As you wrote it is a "semi dedicated hosting plan" and so I assume the WebServer is shared across a number of users. For such a plan I think it is reasonable to limit the resource usage per user and 100 connections seems to be okay for such a plan and absolutely sufficient for 25 daily users.

Thus you should find out why you this limit is exceeded and I would bet that you will see a lot of requests in your log from nice people trying to do some bad things. Probably your provider should have better DOS/Spam controls in place.   

Thank all for information!