I'll speculate they're using the referrer, although I think that only lets you jump up one level and then you're stuck. The client isn't required to send the referer header so it may not work at all. Still there are some plausible situations in which it works.
