thanks - I ran the dumper script and thesea re the values I get:

$VAR1 = {
          'QUERY_STRING' => '',
          'HTTP_X_FORWARDED_FOR' => '81.78.90.129',
          'SERVER_ADDR' => '212.67.202.134',
          'HTTP_ACCEPT_LANGUAGE' => 'en-gb',
          'SERVER_PROTOCOL' => 'HTTP/1.1',
          'HTTP_CONNECTION' => 'keep-alive',
          'HTTP_ACCEPT' => 'image/gif, image/x-xbitmap, image/jpeg, im
+age/pjpeg, */*',
          'HTTP_USER_AGENT' => 'Mozilla/4.0 (compatible; MSIE 6.0; Win
+dows NT 5.1; Alexa Toolbar)',
          'GATEWAY_INTERFACE' => 'CGI/1.1',
          'HTTP_HOST' => 'www.photographersdirect.com',
          'SERVER_SOFTWARE' => 'Apache/1.3.27 (Unix)  (Red-Hat/Linux) 
+Chili!Soft-ASP/3.6.2 mod_ssl/2.8.14 OpenSSL/0.9.6b PHP/4.1.2 FrontPag
+e/5.0.2.2510',
          'SERVER_ADMIN' => 'webmaster@photographersdirect.com',
          'REMOTE_ADDR' => '195.92.67.69',
          'SCRIPT_NAME' => '/formmail/dumper.cgi',
          'SERVER_NAME' => 'photographersdirect.com',
          'HTTP_ACCEPT_ENCODING' => 'gzip, deflate',
          'DOCUMENT_ROOT' => '/home/picturesea/public_html',
          'REQUEST_URI' => '/formmail/dumper.cgi',
          'HTTP_VIA' => '1.1 webcacheH05 (NetCache NetApp/5.3.1R2)',
          'REQUEST_METHOD' => 'GET',
          'SCRIPT_FILENAME' => '/home/picturesea/public_html/formmail/
+dumper.cgi',
          'PATH' => '/usr/local/bin:/usr/bin:/bin',
          'SERVER_PORT' => '80'
        };
[download]

I can't see anything here that shows the file it redirected from.

Edit: BazB changed pre tags to code tags.