Many years ago I was involved in running rather large IP networks and.. well, we'd get bored. So bored, in fact, that we'd try "stuff" with other networks. Here's something interesting we discovered - peers were willing (and doing!) to carry IP transit between two points that they peered at.
So, we thought. We're in one location (say, peering point A and B.) The shared ethernet fabric has "peering exchange" IP addresses (198.32.*, IIRC.) Another network provider peers at A and B, again on the same ethernet fabric. Their IGP would probably have been configured up to 'redistribute connected subnets' into their IGP, and thus their router(s) at A would know they could get to B by their internal network, and vice versa. What would happen if we injected a packet into their network from location A with a source IP of the A's peering point fabric and a destination IP of B's peering point fabric?
Answer: the packet arrived.
Hmm, we thought. Is this enough to bring up an IP tunnel? Indeed it was. We configured up a GRE tunnel, set the endpoint addresses to be our routers' peering IPs (on A and B), used an IP route-map to set the next-hop of these tunnel packets into the providers' routers at A and B.. and connectivity occured.
This wasn't strictly "stealing transit" - it was only a link between two locations on the internet. Ok, so it was "stealing bandwidth." We had a router at location B which was "fully peered" (for whatever you want that to mean to give us the "whole internet" (for, again, whatever you want that to mean)) - so we added an announcement for a /24, routed that /24 down the tunnel ..