The rate of increase in users exceeds the number of downloads.
Looking at the other facts here makes this unlikely, but don't forget that users may be sharing the files somewhere else, so the actual number of users could far outnumber the number of downloads from the official site. Quite frankly I consider that a good thing, since I think users should be allowed to do that - and look on the bright side, your add-on would not be shared in such a fashion if users didn't like it.
Also, I wouldn't be hasty in calling this "malware"... perhaps it's a benevolent mod that someone did, and was shared it on a forum somewhere. I know that you likely don't approve of such a thing, but it's basically what the Android community does (share modded apps) and I don't think it's fundamentally bad; it's one of the reasons why I prefer it to a more walled-garden ecosystem. I say this from the perspective of both an author and user.
Looking at the other facts here makes this unlikely, but don't forget that users may be sharing the files somewhere else, so the actual number of users could far outnumber the number of downloads from the official site. Quite frankly I consider that a good thing, since I think users should be allowed to do that - and look on the bright side, your add-on would not be shared in such a fashion if users didn't like it.
Also, I wouldn't be hasty in calling this "malware"... perhaps it's a benevolent mod that someone did, and was shared it on a forum somewhere. I know that you likely don't approve of such a thing, but it's basically what the Android community does (share modded apps) and I don't think it's fundamentally bad; it's one of the reasons why I prefer it to a more walled-garden ecosystem. I say this from the perspective of both an author and user.