Noticed a severe drop in organic rankings and traffic, after investigating what might have been the cause we have found 3 websites that have duplicated the site within their domains. When you click on the duplicated pages on these domains, they 302 redirect to Amazon.

We believe these sites may have been hacked, (or are purposefully doing this) as there are also other websites being duplicated within the domains, all the duplicated sites are in the same niche, t-shirt printing, and the Amazon store they are 302 redirecting too sells T-shirts.

When doing a search for the company name of the main site, two of these sites appear above the main website, in position 1 and 3. 

When checking Google's cache of the main site, the website that Google is saying the cache is for the hacked sites, not the main site. 

The website is on a hosted CMS and the company is adamant that neither their CMS or their hosting has been compromised, nor is the site.

It looks like some kind of 302 proxy hack as outlined here: <http://www.seofaststart.com/google-proxy-hacking/> but if its simply that, how is Google seeing the main sites as the hacked sites when caching it?

I have crawled the site with the user agent set to Google-bot, and there doesn't seem to be any cloaked redirects, canonical tags, external links or other wise.