is it at all possible that your indexer's licensing configuration allows it to accept connections from any indexers by default? by default, this is how the licenser is configured, from
http://www.splunk.com/base/Documentation/latest/Admin/Createalicensepool :
"When you install an Enterprise license onto a brand new Splunk server, Splunk automatically creates an Enterprise license stack called Splunk Enterprise Stack from it and defines a default license pool for it called auto_generated_pool_enterprise.
The default configuration for this default pool adds any license slave that connects to this license master to the pool. You can edit the pool to change this configuration, to add more indexers to it, or create a new license pool from this stack."
it seems like a long shot, but perhaps there are other indexers at your organization connecting as license slaves to your indexer?
another possibility is that you are using deployment server and that every time it restarts its deployment clients (the forwarders), they report into the indexer as a new license slave?
all very speculative, i'm afraid. i recommend submitting a case to Splunk Support.
