Every month we send out a legitimate email to clients and website users who have requested it. Last month, for example, we sent out 10,163 emails, and 887 of them (ie about 9%) exhibited the following behaviour (the proportion seems pretty consistent each month - one theory I have is that it only applies to long numbers in the querystring whose values are lease than about 3600000!).
The email contains a querystring parameter called p which is always 6 or 7 digits, and another called nl which is 4 digits. The value for nl is unaltered (whatever the order of the querystring parameters used), but the value for p is being changed by adding randomly either 2 or 3 to each digit (with a slight preference for 3, it seems). The email client (or spam filter?) then clicks on each link in the email with this adjustment made.
I don't mind that a machine is generating this extra traffic, although it's taken me a while to realise what's going on, but can anyone throw any more light on the subject? If I hadn't spent ages doing detective work, I wouldn't have believed the above explanation was realistically plausible!