lucy24 - 4:32 am on Feb 17, 2012 (gmt 0)

#3 is easy. The person who owns domain #2 is tracking the two sites-- yours and the ::cough-cough:: unathorized mirror-- via his own logs. There is a technical term which I have only just learned-- and just as quickly forgot. I call them administrative gifs. In effect, they're intentional hotlinks.