Thanks for the rapid response
Correct - The neopixel are powered from the 5V header pin - the data pin sends the signal.
"Kinda surprised you didn't smoke the 5V regulator, which is only rated for 800mA." - so, i guess I should thank my lucky stars I got away with this and not try it again.
The question still remains - how did i get away with it? It indicates the regulator has a massive tolerance