Hi Lloyd,
I assume the checkbox "Install new versions automatically" might participate in this issue here.
Besides giving us some trouble pre SP7 by updating to IE11, this feature which was added in IE10 seems not only to update major IE releases, but also minor updates including those hotfixes, very much like Firefox, Chrome etc. already did before. As those hotfixes are also distributed by Windows Update, I wonder if it is possible to filter automatic updates if WSUS is used.
I think updates installed here might not show up in Programs and Features, but you might find those in your update history.
Auto update can be inhibited by either a registry key or manually unchecking.
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main]
"EnableAutoUpgrade"=dword:00000000