If she'd just stolen them, then we'd probably not have found out (as easily) that she had them. Because she had them directly linked from our server they show up in webstats, and are easily trackable.

Shit like this is why a lot of hosts like geocities and angelfire and others have stopped allowing remote linking, because this is fairly common place behaviour. It can be a huge drain on a site host's bandwidth, and if you have to pay for bandwidth amounts used (rather than a fixed amount for unlimited usage) then you're kind of screwed by other sites using your bandwidth also.