Notepad++ checks a known URL for updates. He'll have spoofed the URL to tell Notepad++ that there was an update, his.