How? The BMC can intercept and inject any ethernet frames that it cares to inject.
I'm responsible for netsec at my company and I've never seen any indication of the BMC network activity on primary network ports after I've configured the BMC in BIOS to use it's dedicated network port.