Did they check the source of the request? My guess would have been an extension doing this instead of the site.