The management engine can talk to ethernet cards directly, without using PCIe or the OS, via SMBus, look at the thing labelled "SMLink0" on Figure 5-2 on page 38 of http://www.intel.com/content/dam/www/public/us/en/documents/...
Indeed, the ethernet controller's datasheet that shows that it can send ethernet traffic over SMBus: http://www.intel.com/content/dam/www/public/us/en/documents/...
Is there something similar with wireless LAN cards?