I had some wierd behavior on a web site, it seemed that something had found a unlinked page that I use to control publishing of articles. The URL for it is not anywhere on my site, and is wierd enough that it is not guessible. After looking through my logs I found out it was an agent IA_Archiver and a alexa IP address that had hit the URL and triggered it to do all sorts of bad things. Again this is a page that nothing links to. Could it be that the alexa toolbar I run on my PC sent the URL to alexa and that's how it found my hidden page? [Yes, now it is password protected]
It is a possibility that any toolbar could do that - as well as a competitor looking to cause 'all sorts of bad things' by submitting it to a search engine. Robots exclusion and/or password protection are the way to control these mishaps.
Yes, the Alexa toolbar sends back your visited URLs to their server, that's how they make their site statistic ranks. Very likely that they use that for spidering, too.