[cd34]

They use javascript to create an iframe to load the image remotely. As a result, there is no referrer, and, most anti-hotlinking rules allow the empty referrer. It's not like you couldn't do it with an iframe and meta-refresh or a dozen other ways.

Blocking the non-referral hits could impact real viewers running certain privacy software, but, its a difficult thing to police.

I don't know that there is a better solution without considerable work. The one solution that used to protect against these types of things disappeared years ago, though, it wasn't a simple solution.