Good digging, and I think you're right, this certainly explains how the data could have inadvertently made it from Referrer into the request.