Oh, right, they just got document.referrer, I had forgotten about that.

What if the analytics server actually parsed the referring page to see if there's a real link there and only confirm the referrer after that? Isn't there a third party service that checks these things?