There are many reasons why our systems might attribute a few impressions to sites that you do not control and that do not directly have your ad tag on them. These can include:
Sites that serve the contents of your site from their own domain. For example, Google cached search results and Google Translate may retrieve your content, then serve it from a Google domain, without iframes (in this case the content is shown through webcache.googleusercontent.com and translate.googleusercontent.com).
Improper iframed redirects. For example, some sites create an iframe through which they reference another site. If improperly implemented, any ad calls on the nested site appear in the performance report as coming from the encapsulating service.
Web pages forwarded in email clients.
Duplicating (i.e. copy and pasting) of stories from one publisher to another.