Hi,
It's possible. Most likely, it could be search engines finding the products one way or another.
The best would be to look at your web server's access log. In it, you'll have one row for each URL called by someone (or something) with information like the browser used (or the bot name), the IP address, the referer, etc.
So you can search for URLs with "updatecart" in them to catch the entries for "add to cart" actions. The browser name / bot name and the referer should help you understand who they are and how they reached the add to cart.
For an in depth explanation about that access log, how to set it up, how to analyse it, get statistics, etc, here is a great documentation:
www.netnea.com/cms/apache-tutorial-5_extending-access-log/
But it requires some knowledge about the unix command line, and access to the SSH of the server which your host might not provide.