He could tell she was browsing https://del.icio.us/ and was able to find her account and see what she "bookmarked" there.

He could tell that they submitted the website to Delicious, which would be an HTTP(S?) request, not a bookmark to their own browser.

I'd assume by looking for a favicon request without any other requests.