John, just one of the ways this apparently works. Outrightly replacing the affiliate code on the way in might be illegal (interference of a business transaction), but popping another window to change a cookie or otherwise misleading a tracking system might not have the same legal implications.
You might want to check the other thread on the issue, or get your programmers to have a look... heck, infect a PC with some of the spyware and get your guys to watch what happens
Alex