I wouldn't be so quick to assume foul play. Could it be some piece of software installed on the recipients browser/machine that is sending the links off somewhere to be scanned?