Non WSUS machines picking up windows updates

Basically in our environment we have a few hundred machines, recently we have began deploying WSUS and serving updates to certain machines. We have only assigned a small handful of machines to get updates from our WSUS server, but it seems a number of other machines are picking up these updates? Is this actually possible, currently we are assigning machines through a GPO and its working perfectly, we have the GPO replicated in various OU's, or in certain cases manually entered the address etc on the machine locally... Any Ideas?