My guess is that it detects natural access to the post by browsing new/top etc. versus direct link access followed by a vote and disconnect plus perhaps some vote distribution detection (i.e. a cluster of direct access votes indicates a ring)

I imagine full disclosure would simply encourage more sophisticated voting rings :P