Yes, I have found this is a limitation of yum. It would be nice if the information about the source repository could be stored somewhere.
If these were installed after the initial OS installation, and you haven't done a yum clean, you might be able to glean some info from the cache: # ls -l /var/cache/yum/*/packages
This won't give you any information about packages installed using rpm directly instead of yum.
tony, i did yum clean when i upgraded to 5.3