Interesting! How would they actually do that - particularly if the network
is using a set of totally non-standard IP addresses, like mine is, and if
SSID broadcasting is turned off?

Just analysing network traffic to see what others are using.

One also hears about 'spoofing' MAC addresses. How's that done?

Network cards can be assigned a MAC address to override the built in one.
You need to listen to existing traffic again to snatch an allowed address.

Christian.