How do you know it's a hotlink?
I just use that term any time you see images or other media extracted from the site without the page being loaded.
People do bookmark images, which I've done in the past, and bookmarked images don't have referrers. Based on the OP's description of the image, and that it was a one time event, is what I would conclude.
How someone could 'hotlink' an image and not get referrers from a browser would be to use an image server, a proxy if you will, where their server grabs your image on demand. Meaning the browser never directly connects with your site. I had someone do something like this to gain access to about 40K screen shots I have using some PHP script.
Not anymore ;)
Hard to say for sure but it's always more amusing to speculate when DHS, DOD, etc. is doing it.
While we're on the topic, once upon a time I made a blog post about the government using a specific scraper service that scraped and sold 'reports' to them. Must've hit a real nerve as I quickly saw a bunch of focused hits from that company, DHS, DOD, and of all places, Arlington apts. as someone was reading from home. I kept waiting for the black helicopters to land in my backyard because I figured out their little secret. Nothing happened, my car didn't explode, but I'll bet I have a file.
It's almost as much fun as some of my blog posts that got immediate hits from corporate lawyers for those companies as I was sure I was about to get sued a time or two based on the volume of hits from those law offices.
That's when I decided to stop looking.
As much fun as it is seeing the DHS on your site, it can lead to paranoia, sleeplessness, needless changes to .htaccess, and worse!
