I think they use IP addresses too. An old colleague once created a fake account to test an app, using totally fake data. Next time I signed up he appeared in the sidebar.