Yes it can, for example using :
- A reference to an external JS or css file
- An iframe
- or even a HTTP 302 redirect.
This can be used by online malware to generate trafic for a DDoS Attack.
Note, all those are used for legitimate purpose on many (most) websites, and hence do not imply a malicious behavior.
In response to your edit: Yes, Ajax can do this, although I don't think I've already seen this for SQL Injections (whereas XSS or XSRF for example are frequently exploited this way). Other possibilities might include that your server has been compromised and is used as a proxy by an attacker to conduct SQL Injection attacks, or you are running a Tor exit node that is used by an attacker (whether you know it or not).