I just took that link unit off that page for now and hopefully they wont be back.
Was it tracked via a URL channel or a custom channel?
Besides, taking it off the page doesn't take it out of the page on Google cache, or his browsers cache if it's still on his screen, or a local copy if they saved the page locally, or from the internet archives even (Archive.org).
Don't think real crazy things don't happen because I use a page tracking system like LivePerson that allows me to monitor all pages being viewed, assuming they have javascript enabled.
Sometimes I see a page being viewed from something like "file:///C:/Users/JoesPC/Desktop/mypage.html" so I'll break in for a chat "stealing my stuff Joe?" and the connection usually goes >POOF!< instantly as Joe has a heart attack.
I've had idiots copy my pages to their new site leaving both my AdSense and LivePerson intact, real easy to find the first time someone opens that page :)
Anyway, the point was, your website is the least of your vulnerabilities, and you can tighten control by eliminating SE cache copies or archives where nitwits go to play games with your site.