Ok this is crap. I've been playing around with Xolox 1.3 &1.4 Beta1 build461 and both share all my files in the default DOWNLOADS directory (in my case C:\Program Files\XoloX\downloads) even though I have no directories shared in my UPLOADS directory.

I detected it by seeing my firewall activity light going crazy and noticing an inbound connection - sure enough when I turned on 'Tools/My uploads visible' some was down loading without my knowledge.