The way these strikes happen is that the right holder (or usually just some company on their behalf) joins public torrents for their content, and grabs every ip that connects. It’s entirely possible that in the few seconds you had qbit open without a vpn, enough of the program had initialized that the basics of joining the swarm started, and your ip got seen.