For the hack to work, the victim's computer had to get a cookie from ebay. The widget caused this cookie to get downloaded to the victims computer, but only this cookie. Normal visits from legitimate users get everything on the page. Adding a small invisible file meant that a normal user would get this file as well as the cookie but the malicious widget would only grab the cookie.

Finding out how many IP's were legit vs bogus was then a simple matter of going through the http logs making sure all gets of the cookie had matching gets of the gif. Cookie gets without gif gets were fraud.