Demaestro - 11:39 pm on Feb 19, 2013 (gmt 0)
If we put Joomla into maintenance mode, it also put's their domain redirected site into maintenance mode.
I assume by this you mean that you used the setting in global config to put the "site offline" or into "debug mode"?
If that is correct then there is something else going on here as both of those settings live in a config file. If you are changing the config file which writes to a flat .php file and not a database then they are most likely linking back to your site.
Either that or the host server is so fully taken over in an attack that they were able to mirror flat files and change them at the same moment you do. Which is unlikely.
I think whatever is happening they are pointing it back to your site.... the real question is how is the .htaccess file routing traffic from that domain to the public directory of your site?