Renting out bandwidth to the "competition" is not uncommon. It's not really competition when you're making money.

>this shouldn't even be possible since CORS should stop it, right...?

CORS is meaningless outside the controlled environment of a web browser. Besides, CORS is opt-in. Website operators can chose whether or not to share (it's in the name).