Mmm.. having thought and read about all of this much more now, I believe Bitt's assessment to be pretty accurate. Ethernet broadcasts are probably leaking out, and the ISP and/or carrier could perform ARP attacks back in if they felt like it.

I'll fix that in my setup with a VLAN sometime Real Soon Now.

Cheers