I check CPanel and if the referring URL is going to an image, then it's being hotlinked. I usually fix that by making another image that says "I am a bandwidth thief" and name it the same as the image being linked to, renaming the original first. I find that usually they remove the image fairly quick!!