You're right. There are rarely referring urls for it, which implies that it spreads primarily by email.