Thanks for everybody's emails and comments. Some have requested further information. I don't have much, but here you go:

This site is hosted in the US, but the music files were stored on my Linux server at home to save space.

I've checked the logs for both this site and my home machine. There's no access that corresponds with the time that the BPI gave. But there is a spike of activity on both servers from an IP address of 212.111.42.11 around that hour. The user-agent string is "Mozilla/4.0 (compatible; MSIE 5.0; Windows NT; DigExt)". which doesn't seem special in any way, and I can't find any referral data, so I have no clue how they got here. The address doesn't resolve, but SideBit's Locator places it in the UK. The address is now blocked at my firewall, but that's just me being petty rather than a serious attempt at blocking their access.

The moral of the story seems to be: if you're running a music blog, make sure you don't host the files in the UK.