Doc,
I'm more inclined to think that something got installed into his browser software that adds random links whenever he opens a form.
Let me look into it a little....